secondopinionlabs

TypeScript tracing SDK for medical AI agents, with best-effort PHI detection built in and ON by default.

We never claim "HIPAA-compliant redaction." The SDK provides best-effort PHI detection to help you avoid sending sensitive data; you remain the redactor of record. v1 detects: US SSN, US phone, email, MRN (configurable pattern), DOB, NPI, DEA, and ICD codes when co-occurring with another identifier. It does NOT detect names or non-US patterns.

Usage

import { init, wrapAnthropic } from "secondopinionlabs";
import Anthropic from "@anthropic-ai/sdk";

const sentinel = init({
  apiKey: process.env.SENTINEL_API_KEY!, // sntl_live_… / sntl_test_…
  baseUrl: "https://api.your-sentinel.example", // omit for local dev
  // redactPhi: false,                   // explicit opt-out only
  // mrnPattern: /MRN-\d{8}/,            // workspace-specific MRN format
});

const trace = sentinel.startTrace();

// Automatic: every messages.create becomes an "llm" span.
const anthropic = wrapAnthropic(new Anthropic(), trace);
await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "..." }],
});

// Manual spans for tools / retrieval / agent steps:
const span = trace.startSpan("ehr-lookup", { kind: "tool" });
try {
  // ... work ...
  span.end({ status: "ok" });
} catch (err) {
  span.end({ status: "error" });
  throw err;
}

await sentinel.shutdown(); // flush before process exit

Spans are batched (100 spans or 5s, whichever first) and delivered to POST /v1/spans. Retries are safe: the server deduplicates on (workspace, span_id). Streaming Anthropic calls are traced without completion text/token counts in v1.