Documentation

// Run as an ES module: a .mjs file, "type": "module" in package.json, or npx tsx file.ts
// Your API key needs agents:read, agents:write, permissions:read, audit:read and audit:write.
import createVorim from '@vorim/sdk';

// 1. Initialize with your API key
const vorim = createVorim({
  apiKey: 'agid_sk_live_your_api_key_here',
  // baseUrl defaults to the hosted API; set it only for self-hosted.
});

// 2. Register an agent
const agent = await vorim.register({
  name: 'InvoiceBot',
  description: 'Processes and sends invoices',
  capabilities: ['api_access', 'email_send'],
  scopes: ['agent:read', 'agent:write', 'agent:communicate'],
});

console.log('Agent ID:', agent.agent.agent_id);
console.log('Private Key:', agent.private_key);  // Save this! Shown only once.

// 3. Check permissions before performing actions
const check = await vorim.check(agent.agent.agent_id, 'agent:write');
if (check.allowed) {
  // Perform the action...

  // 4. Emit an audit event
  await vorim.emit({
    agent_id: agent.agent.agent_id,
    event_type: 'api_request',
    action: 'POST /invoices',
    resource: 'invoices',
    result: 'success',
    latency_ms: 42,
  });
}

# npm
npm install @vorim/sdk

# yarn
yarn add @vorim/sdk

# pnpm
pnpm add @vorim/sdk

Full type definitions included. The SDK re-exports types from @vorim/shared-types for convenience.

import { deviceLogin } from '@vorim/sdk';

// No API key needed to start. The agent runs this; you approve in the browser.
const { api_key, agent } = await deviceLogin({
  clientName: 'my-app',
  registerAgent: true, // also register a first agent identity with the new key
  onUserCode: ({ user_code, verification_uri }) => {
    // Show the human this, verbatim:
    console.log(`Approve at ${verification_uri} and enter code ${user_code}`);
  },
});

console.log('API key:', api_key);            // scopes: agents:read, agents:write, permissions:read, audit:write
console.log('Agent:', agent?.agent.agent_id); // first agent, ready to use
console.log('Private key:', agent?.private_key); // shown once, store it

from vorim import device_login

result = device_login(
    client_name="my-app",
    register_agent=True,
    on_user_code=lambda i: print(
        f"Approve at {i['verification_uri']} and enter code {i['user_code']}"
    ),
)
api_key = result["api_key"]
agent = result["agent"]  # first agent identity, with its one-time private_key

# Paste one line into your coding agent:
Read https://vorim.ai/agents.md and follow the device-flow bootstrap to get an
API key, then integrate per https://vorim.ai/docs

The unauthenticated start endpoint creates a pending request, not a credential. Only the hashes of the device and user codes are stored. The code is single use and expires in 10 minutes. The minted key is returned exactly once and is revocable in Settings. It expires in 90 days by default, and you can request a shorter lifetime at start, down to one day, so a short-lived task agent gets a key that dies with the task. The server caps the request at 90 days, so a malformed one can never mint a longer-lived key than policy allows. The agent automates the plumbing. It does not replace your consent.

import createVorim from "@vorim/sdk";
import { wrapTools, VorimCallbackHandler, createVorimAgent } from "@vorim/sdk/integrations/langchain";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });

// Option 1: Wrap existing tools
const guardedTools = wrapTools([searchTool, analysisTool], {
  vorim,
  agentId: "agid_acme_a1b2c3d4",
  permissionMap: { search_docs: "agent:read" },
});

// Option 2: Callback handler (observability only, non-blocking)
const handler = new VorimCallbackHandler(vorim, "agid_acme_a1b2c3d4");
await agent.invoke({ messages }, { callbacks: [handler] });

// Option 3: Full agent factory (register + wrap + observe)
const { agentId, tools, callbackHandler } = await createVorimAgent({
  vorim,
  name: "research-agent",
  capabilities: ["web_search"],
  scopes: ["agent:read", "agent:execute"],
  tools: [searchTool, analysisTool],
});

import createVorim from "@vorim/sdk";
import { wrapTools } from "@vorim/sdk/integrations/langchain";
import { getLangChainTools } from "@coinbase/agentkit-langchain";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });

// AgentKit exposes its action providers as LangChain tools...
const agentKitTools = await getLangChainTools(agentKit);

// ...and Vorim gates + signs each one before it executes.
const guardedTools = wrapTools(agentKitTools, {
  vorim,
  agentId: "agid_acme_a1b2c3d4",
  permissionMap: {
    // an onchain transfer / swap moves value → agent:transact
    native_transfer: "agent:transact",
    erc20_transfer:  "agent:transact",
    // reads (balances, price feeds) → agent:read
    get_balance:     "agent:read",
  },
  // Growth+: link every action to a runtime allow/deny/escalate decision.
  useRuntimeControl: true,
});

import OpenAI from "openai";
import createVorim from "@vorim/sdk";
import { VorimToolRegistry, runAgentLoop } from "@vorim/sdk/integrations/openai";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });
const openai = new OpenAI();

const registry = new VorimToolRegistry({ vorim, agentId: "agid_acme_a1b2c3d4" });

registry.add({
  name: "search_docs",
  description: "Search internal documents",
  parameters: { type: "object", properties: { query: { type: "string" } }, required: ["query"] },
  execute: async ({ query }) => searchDocs(query),
  permission: "agent:read",
});

// Use with chat completions
const response = await openai.chat.completions.create({
  model: "gpt-4o",
  messages,
  tools: registry.toOpenAITools(),
});

// Execute tool calls — permission checked + audited automatically
const toolMessages = await registry.executeToolCalls(
  response.choices[0].message.tool_calls ?? []
);

import createVorim from "@vorim/sdk";
import { registerCrew, emitCrewTaskEvent, verifyCrewTrust } from "@vorim/sdk/integrations/crewai";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });

const crew = await registerCrew(vorim, {
  crewName: "content-pipeline",
  members: [
    { role: "researcher", name: "crew-researcher", capabilities: ["web_search"], scopes: ["agent:read", "agent:execute"] },
    { role: "writer", name: "crew-writer", capabilities: ["file_write"], scopes: ["agent:read", "agent:write"] },
    { role: "editor", name: "crew-editor", capabilities: ["review"], scopes: ["agent:read", "agent:write"], allowDelegation: true },
  ],
});

// Verify trust before running
const trustReport = await verifyCrewTrust(vorim, crew);

// Audit each task
await emitCrewTaskEvent(vorim, {
  role: "researcher",
  agentId: crew.getMember("researcher").agentId,
  task: "research_competitors",
  tool: "web_search",
  result: "success",
  latencyMs: 3200,
});

import createVorim from "@vorim/sdk";
import { wrapTool, createVorimAgent } from "@vorim/sdk/integrations/llamaindex";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });

// Wrap a single tool
const guarded = wrapTool(searchTool, {
  vorim,
  agentId: "agid_acme_a1b2c3d4",
  permissionMap: { search: "agent:read" },
});

// Or use the agent factory
const { agentId, tools } = await createVorimAgent({
  vorim,
  name: "research-agent",
  capabilities: ["search", "write"],
  scopes: ["agent:read", "agent:write", "agent:execute"],
  tools: [searchTool, writeTool],
  permissionMap: { search: "agent:read", write: "agent:write" },
});

// const agent = new OpenAIAgent({ tools });

import Anthropic from "@anthropic-ai/sdk";
import createVorim from "@vorim/sdk";
import { VorimToolRegistry, runAgentLoop } from "@vorim/sdk/integrations/anthropic";

const vorim = createVorim({ apiKey: "agid_sk_live_..." });
const anthropic = new Anthropic();

const registry = new VorimToolRegistry({ vorim, agentId: "agid_acme_a1b2c3d4" });

registry.add({
  name: "search_docs",
  description: "Search internal documents",
  input_schema: { type: "object", properties: { query: { type: "string" } }, required: ["query"] },
  execute: async ({ query }) => searchDocs(query),
  permission: "agent:read",
});

// Use with Claude messages API
const response = await anthropic.messages.create({
  model: "claude-sonnet-4-20250514",
  max_tokens: 1024,
  messages,
  tools: registry.toAnthropicTools(),
});

// Execute tool_use blocks — permission checked + audited automatically
const toolResults = await registry.executeToolUseBlocks(
  response.content.filter(b => b.type === "tool_use")
);

// Or use the full agent loop
const answer = await runAgentLoop({
  vorim,
  agentId: "agid_acme_a1b2c3d4",
  anthropic,
  model: "claude-sonnet-4-20250514",
  systemPrompt: "You are a helpful assistant.",
  registry,
  userMessage: "Find docs about onboarding",
});

npm install -g @vorim/mcp-server

{
  "mcpServers": {
    "vorim": {
      "command": "npx",
      "args": ["-y", "@vorim/mcp-server"],
      "env": {
        "VORIM_API_KEY": "agid_sk_live_..."
      }
    }
  }
}

extensions:
  vorim:
    enabled: true
    type: stdio
    cmd: npx
    args:
      - "-y"
      - "@vorim/mcp-server"
    env_keys:
      - VORIM_API_KEY
    timeout: 300

cos mcp add --transport stdio -e VORIM_API_KEY=agid_sk_... vorim -- npx -y @vorim/mcp-server

{
  "mcpServers": {
    "vorim": {
      "transport": "stdio",
      "command": "npx",
      "args": ["-y", "@vorim/mcp-server"],
      "env": {
        "VORIM_API_KEY": "agid_sk_..."
      }
    }
  }
}

// In Claude Desktop or Cursor, just ask:
"Register an agent called invoice-processor with read and execute permissions"
"Check if agent agid_acme_a1b2 has permission to execute"
"Log a tool_call event for agent agid_acme_a1b2: action=process_invoice, result=success"
"What's the trust score for agent agid_acme_a1b2?"
"Export the audit trail for the last 7 days"

curl https://vorim.ai/.well-known/agent.json

# TypeScript
npm install @vorim/a2a

# Python (included in vorim >= 3.1.0)
pip install vorim

import { createVorimA2A } from '@vorim/a2a';

const a2a = createVorimA2A({ apiKey: 'agid_sk_...' });

// Extend an existing Agent Card with Vorim identity
const card = await a2a.extendAgentCard(baseCard, 'agid_abc123');

// card.vorimIdentity = {
//   agentId: "agid_abc123",
//   publicKeyFingerprint: "a3f2...e91c",
//   trustScore: 82,
//   status: "active",
//   scopes: ["agent:read", "agent:execute"],
//   verifyUrl: "https://vorim.ai/v1/trust/verify/agid_abc123",
//   badgeUrl: "https://vorim.ai/v1/trust/badge/agid_abc123.svg",
//   verifiedAt: "2026-04-15T12:00:00Z"
// }

// Verify an incoming agent's identity and trust
const result = await a2a.verifyAgent(incomingAgentCard);

if (result.trusted) {
  console.log(`Verified: score ${result.score}, status ${result.status}`);
} else {
  console.log(`Rejected: ${result.reason}`);
  // "Trust score 32 is below minimum 50"
  // "Agent is suspended"
  // "Peer is missing required scope(s): agent:write"
}

// Verify with custom requirements
const strict = await a2a.verifyAgent(card, {
  minTrustScore: 70,
  requiredScopes: ['agent:read', 'agent:execute'],
});

// Auto-verify incoming A2A requests
const handler = a2a.middleware({
  minTrustScore: 70,
  requiredScopes: ['agent:read'],
  auditLog: true,      // log interactions as audit events
})(async (req) => {
  // Only reached if sender agent passes all checks
  const { vorimVerification } = req;
  console.log(`Trusted agent: score ${vorimVerification.score}`);
  return { status: 'ok' };
});

const card = await a2a.createAgentCard({
  name: 'research-agent',
  url: 'https://my-agent.example.com',
  provider: { organization: 'Acme Corp' },
  skills: [{ id: 'research', name: 'Web Research', tags: ['search'] }],
  scopes: ['agent:read', 'agent:execute'],
});
// Returns a full A2A Agent Card with vorimIdentity extension

from vorim.a2a import VorimA2A

a2a = VorimA2A(api_key="agid_sk_...")

# Extend an Agent Card
card = a2a.extend_agent_card(base_card, agent_id="agid_abc123")

# Verify an incoming agent
result = a2a.verify_agent(incoming_card, min_trust_score=60)
if result.trusted:
    print(f"Verified with score {result.score}")

# Create a new agent with A2A card
card = a2a.create_agent_card(
    name="research-agent",
    url="https://my-agent.example.com",
    scopes=["agent:read", "agent:execute"],
)

# Decorator middleware
@a2a.middleware(min_trust_score=70, required_scopes=["agent:read"])
def handle_task(request):
    return {"status": "ok"}

// Express example
app.get('/.well-known/agent.json', async (req, res) => {
  const card = await a2a.discoveryEndpoint('agid_abc123', {
    name: 'my-agent',
    url: 'https://my-agent.example.com',
    skills: [{ id: 'research', name: 'Web Research' }],
  });
  res.json(card);
});

pip install vorim pydantic-ai

from vorim.pydantic_ai import VorimDeps
from pydantic_ai import Agent, RunContext

agent = Agent('openai:gpt-4o', deps_type=VorimDeps)

@agent.tool
async def fetch_data(ctx: RunContext[VorimDeps], query: str) -> str:
    # Check permission before acting
    check = ctx.deps.check('agent:read')
    if not check.get('allowed'):
        return 'Permission denied: agent:read not granted'

    result = do_something(query)

    # Log the action
    ctx.deps.emit('data.fetch', outcome='success')
    return result

# Run with Vorim identity
deps = VorimDeps(api_key='agid_sk_...', agent_id='agid_abc123')
result = await agent.run('Fetch the latest data', deps=deps)

from vorim.pydantic_ai import VorimDeps, vorim_tool

agent = Agent('openai:gpt-4o', deps_type=VorimDeps)

@agent.tool
@vorim_tool(scope='agent:read', action='data.fetch')
async def fetch_data(ctx: RunContext[VorimDeps], query: str) -> str:
    # Permission checked automatically before this runs
    # Audit event emitted automatically after this returns
    return do_something(query)

# If permission is denied, tool returns 'Permission denied'
# and a denial audit event is logged

from vorim.pydantic_ai import create_vorim_agent

agent, deps = create_vorim_agent(
    model='openai:gpt-4o',
    api_key='agid_sk_...',
    agent_name='research-agent',
    scopes=['agent:read', 'agent:execute'],
    system_prompt='You are a research agent.',
)

result = await agent.run('Find the latest papers', deps=deps)

# Python
from vorim.stripe_acp import VorimACP

acp = VorimACP(api_key='agid_sk_...', min_trust_score=70)

result = acp.authorize_checkout(
    agent_id='agid_abc123',
    seller='acme-store',
    amount=4999,
    currency='usd',
)

if result['authorized']:
    # Proceed with Stripe ACP checkout
    print(f'Trust score: {result["trust_score"]}')
else:
    print(f'Blocked: {result["reason"]}')

import createVorim from '@vorim/sdk';
import { createVorimACP } from '@vorim/sdk/integrations/stripe-acp';

const vorim = createVorim({ apiKey: 'agid_sk_...' });
const acp = createVorimACP(vorim, { minTrustScore: 70 });

// Agent must send X-Vorim-Agent-Id header
app.post('/checkouts', acp.middleware(), (req, res) => {
  // Only reached if agent has transact permission + trust score >= 70
  const { trustScore, status } = req.vorimAuthorization;
  // Create Stripe checkout session...
});

@acp.require_transact(agent_id_header='X-Vorim-Agent-Id')
def create_checkout(request):
    # Only reached if agent passes all checks
    return process_checkout(request)

Step 1: Create an account at vorim.ai and get your API key from Settings → API Keys.

# Add Vorim as an MCP server via mcporter
mcporter config add vorim --stdio "npx -y @vorim/mcp-server"

# Set your API key
export VORIM_API_KEY=agid_sk_live_...

# Copy the skill to your OpenClaw skills directory
mkdir -p ~/.openclaw/skills/vorim
# Add SKILL.md from github.com/Vorim-AI-Labs/vorim-mcp-server

# Register your agent (first run)
mcporter call vorim.vorim_register_agent name="my-openclaw" \
  capabilities:='["browse","email","shell"]' \
  scopes:='["agent:read","agent:write","agent:execute"]'

# Check permission before a sensitive action
mcporter call vorim.vorim_check_permission \
  agent_id="agid_..." scope="agent:execute"

# Log an action to the audit trail
mcporter call vorim.vorim_emit_event \
  agent_id="agid_..." event_type="tool_call" \
  action="send_email" result="success"

# Verify trust score
mcporter call vorim.vorim_verify_trust agent_id="agid_..."

curl -fsSL https://vorim.ai/hooks/kiro/install.sh | bash

# key scopes: permissions:read, audit:write
export VORIM_API_KEY=agid_sk_live_...
export VORIM_AGENT_ID=agid_...

{
  "version": "v1",
  "hooks": [
    {
      "name": "vorim-permission-gate",
      "trigger": "PreToolUse",
      "matcher": "write|shell|@mcp",
      "action": { "type": "command", "command": "node .kiro/vorim/vorim-hook.mjs pre" },
      "enabled": true
    },
    {
      "name": "vorim-audit",
      "trigger": "PostToolUse",
      "matcher": "write|shell|@mcp",
      "action": { "type": "command", "command": "node .kiro/vorim/vorim-hook.mjs post" },
      "enabled": true
    }
  ]
}

mkdir -p .claude/skills/add-vorim
curl -fsSL https://vorim.ai/hooks/nanoclaw/add-vorim/SKILL.md -o .claude/skills/add-vorim/SKILL.md
curl -fsSL https://vorim.ai/hooks/nanoclaw/add-vorim/REMOVE.md -o .claude/skills/add-vorim/REMOVE.md

# then, in Claude Code inside your NanoClaw checkout
/add-vorim

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Write|Edit|NotebookEdit|Bash|mcp__.*",
      "hooks": [{ "type": "command",
        "command": "NODE_USE_ENV_PROXY=1 node /home/node/.claude/vorim/vorim-hook.mjs pre --agent agid_..." }]
    }]
  }
}

<!-- Drop this on any page -->
<div data-vorim-agent="agid_acme_a1b2c3d4"></div>
<script src="https://vorim.ai/widget/vorim-trust.js"></script>

<div
  data-vorim-agent="agid_acme_a1b2c3d4"
  data-vorim-style="card"
  data-vorim-theme="dark"
></div>
<script src="https://vorim.ai/widget/vorim-trust.js"></script>

<div
  data-vorim-agent="agid_acme_a1b2c3d4"
  data-vorim-style="inline"
></div>

![Vorim Trust](https://vorim.ai/v1/trust/badge/agid_acme_a1b2c3d4.svg)

curl https://vorim.ai/v1/trust/verify/agid_acme_a1b2c3d4

# Returns (payload wrapped in a top-level "data" envelope):
{
  "data": {
    "agent_id": "agid_acme_a1b2c3d4",
    "verified": true,
    "trust_score": 85,
    "trust_band": "trusted",          // untrusted | building | established | trusted
    "confidence": "established",       // new | developing | established (evidence maturity)
    "signals": ["identity_anchor", "reliability", "maturity"],
    "status": "active",
    "owner": { "org_name": "Acme Corp", "verified": true },
    "attestation": {
      "attestation_id": "f544370d-...",
      "agent_id": "agid_acme_a1b2c3d4",
      "trust_band": "trusted",
      "confidence": "established",
      "issued_at": "2026-06-19T15:41:01Z",
      "expires_at": "2026-06-19T15:46:01Z",
      "kid": "93da0741...",            // matches a key from GET /v1/trust/keys
      "signature": "ed25519:aRK3sIs0..."
    }
  }
}

curl https://vorim.ai/v1/trust/keys

# Returns the platform public key(s) for verifying attestations:
{
  "data": {
    "keys": [
      { "kid": "93da0741...", "alg": "ed25519",
        "use": "trust-attestation",
        "public_key_pem": "-----BEGIN PUBLIC KEY-----\n..." }
    ]
  }
}

# Opt an agent into the public directory
curl -X PATCH https://vorim.ai/v1/agents/agid_acme_a1b2c3d4 \
  -H "Authorization: Bearer agid_sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "public_listing": true }'    # set false to remove it again

curl https://vorim.ai/v1/trust/directory

# Returns opted-in agents with their live trust score:
{
  "data": {
    "agents": [
      {
        "agent_id": "agid_acme_a1b2c3d4",
        "name": "invoice-processor",
        "org_name": "Acme Corp",
        "status": "active",
        "trust_score": 85,
        "created_at": "2026-06-01T09:12:00Z"
      }
    ],
    "total": 1
  }
}

# Run directly (no install needed)
npx @vorim/cli init

# Or install globally
npm install -g @vorim/cli

$ npx @vorim/cli init

  ╔══════════════════════════════╗
  ║        VORIM AI CLI        ║
  ║  Agent Identity & Trust Layer ║
  ╚══════════════════════════════╝

→ Setting up Vorim AI in this project
✓ Found API key: agid_sk_live_abc...
→ Testing connection...
✓ Connected to Vorim AI (healthy)
API Key: agid_sk_live_abc...
Project name (my-project): my-project
First agent name (my-project-agent): my-project-agent
→ Registering agent "my-project-agent"...
✓ Agent registered: agid_org_a1b2c3d4
✓ Granted agent:read permission
✓ First audit event emitted
✓ Created vorim.json
✓ Added Vorim keys to .env

# 1. Environment variable
export VORIM_API_KEY=agid_sk_live_...

# 2. .env file in current directory
VORIM_API_KEY=agid_sk_live_...

# 3. vorim.json in current directory (created by vorim init)
{ "apiKey": "agid_sk_live_..." }

<!-- HTML embed -->
<img
  src="https://vorim.ai/v1/trust/badge/YOUR_AGENT_ID.svg"
  alt="Vorim Trust Score"
  width="180"
  height="32"
/>

<!-- Markdown -->
![Vorim Trust](https://vorim.ai/v1/trust/badge/YOUR_AGENT_ID.svg)

<a href="https://vorim.ai/v1/trust/verify/YOUR_AGENT_ID" target="_blank">
  <img
    src="https://vorim.ai/v1/trust/badge/YOUR_AGENT_ID.svg"
    alt="Vorim Trust Score"
  />
</a>

GET https://vorim.ai/v1/trust/verify/YOUR_AGENT_ID

Response (responses are wrapped in a "data" envelope):
{
  "data": {
    "agent_id": "agid_abc123",
    "verified": true,
    "trust_score": 82,
    "trust_band": "trusted",        // untrusted | building | established | trusted
    "confidence": "established",     // new | developing | established (evidence maturity)
    "signals": ["identity_anchor", "reliability", "maturity"],
    "status": "active",
    "owner": { "org_name": "Acme Corp", "verified": true },
    "attestation": {
      "trust_band": "trusted",
      "issued_at": "2026-06-19T15:41:01Z",
      "expires_at": "2026-06-19T15:46:01Z",
      "kid": "93da0741...",          // matches a key from GET /v1/trust/keys
      "signature": "ed25519:aRK3sIs0..."
    }
  }
}

GET https://vorim.ai/v1/trust/directory

Response:
{
  "data": {
    "agents": [
      {
        "agent_id": "agid_abc123",
        "name": "research-agent",
        "org_name": "Acme Corp",
        "status": "active",
        "trust_score": 82,
        "created_at": "2026-04-15T12:00:00Z"
      }
    ],
    "total": 1
  }
}

# Core SDK (requires Python 3.10+)
pip install vorim

# With framework integrations (quote the extras so zsh doesn't expand the brackets)
pip install "vorim[langchain]"    # LangChain / LangGraph
pip install "vorim[crewai]"       # CrewAI
pip install "vorim[openai]"       # OpenAI Agents SDK
pip install "vorim[anthropic]"    # Anthropic / Claude
pip install "vorim[all]"          # All integrations

from vorim import Vorim

vorim = Vorim(api_key="agid_sk_live_...")

# Register an agent
result = vorim.register(
    name="invoice-processor",
    capabilities=["read_documents", "extract_data"],
    scopes=["agent:read", "agent:execute"],
)

# Check permissions (<5ms via Redis)
check = vorim.check(result.agent.agent_id, "agent:execute")

if check.allowed:
    # Emit audit event
    vorim.emit(
        agent_id=result.agent.agent_id,
        event_type="tool_call",
        action="process_invoice",
        result="success",
        latency_ms=142,
    )

# Verify any agent's trust (public, no auth required)
trust = vorim.verify(result.agent.agent_id)
print(f"Trust score: {trust.trust_score}/100")

import asyncio
from vorim import AsyncVorim

async def main():
    async with AsyncVorim(api_key="agid_sk_live_...") as vorim:
        result = await vorim.register(
            name="async-agent",
            capabilities=["search"],
            scopes=["agent:read"],
        )
        print(result.agent.agent_id)

asyncio.run(main())

from vorim import Vorim
from vorim.integrations.langchain import vorim_tool, VorimCallbackHandler

vorim = Vorim(api_key="agid_sk_live_...")

@vorim_tool(vorim, agent_id="agid_acme_...", permission="agent:execute")
def search(query: str) -> str:
    """Search documents."""
    return f"Results for {query}"

# search() is now a standard LangChain tool with Vorim permission checks + audit

from vorim import Vorim
from vorim.integrations.crewai import register_crew

vorim = Vorim(api_key="agid_sk_live_...")

crew = register_crew(vorim, {
    "crew_name": "content-pipeline",
    "members": [
        {
            "role": "researcher",
            "name": "crew-researcher",
            "capabilities": ["web_search"],
            "scopes": ["agent:read", "agent:execute"],
        },
    ],
})

from openai import OpenAI
from vorim import Vorim
from vorim.integrations.openai_agents import VorimToolRegistry

vorim = Vorim(api_key="agid_sk_live_...")
client = OpenAI()

registry = VorimToolRegistry(vorim=vorim, agent_id="agid_acme_...")
registry.add(
    name="search",
    description="Search documents",
    parameters={"type": "object", "properties": {"query": {"type": "string"}}},
    execute=lambda args: f"Results for {args['query']}",
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Search for AI papers"}],
    tools=registry.to_openai_tools(),
)

tool_messages = registry.execute_tool_calls(
    response.choices[0].message.tool_calls or []
)

import createVorim from '@vorim/sdk';

const vorim = createVorim({
  apiKey: 'agid_sk_live_xxxxxxxxxxxxxxxx',
  baseUrl: 'https://api.vorim.ai',  // default
  timeout: 10000,                     // default: 10 seconds
});

Never expose your API key in client-side code. The SDK is designed for server-to-server use. Store your key in environment variables.

const agent = await vorim.register({
  name: 'InvoiceBot',
  description: 'Automated invoice processing agent',
  capabilities: ['api_access', 'email_send', 'file_read'],
  scopes: ['agent:read', 'agent:write', 'agent:communicate'],
});

// Response
{
  agent: {
    agent_id: 'agid_acme_a1b2c3d4',
    name: 'InvoiceBot',
    status: 'active',
    trust_score: 50,
    // ... more fields
  },
  private_key: '-----BEGIN PRIVATE KEY-----\n...',  // Save this!
  public_key: '-----BEGIN PUBLIC KEY-----\n...',
  key_fingerprint: 'a1b2c3d4e5f6...',
}

const agent = await vorim.getAgent('agid_acme_a1b2c3d4');
console.log(agent.name, agent.status, agent.trust_score);

const { agents, meta } = await vorim.listAgents({
  status: 'active',
  page: 1,
  per_page: 25,
});

console.log(`${meta.total} agents total, showing page ${meta.page}`);

await vorim.revoke('agid_acme_a1b2c3d4');
// Agent status is now 'revoked', all permissions denied

const result = await vorim.check('agid_acme_a1b2c3d4', 'agent:write');

if (result.allowed) {
  // Agent is authorized — proceed with the action
  await performWrite();
} else {
  console.log('Permission denied:', result.reason);
}

// Response shape
{
  allowed: true,
  agent_id: 'agid_acme_a1b2c3d4',
  scope: 'agent:write',
  reason: undefined, // populated with the denial reason when allowed is false
}

// Grant with expiration
await vorim.grant('agid_acme_a1b2c3d4', 'agent:transact', {
  valid_until: '2027-06-01T00:00:00Z',
});

// Grant with rate limiting
await vorim.grant('agid_acme_a1b2c3d4', 'agent:communicate', {
  rate_limit: { max: 100, window: '1h' },
});

await vorim.emit({
  agent_id: 'agid_acme_a1b2c3d4',
  event_type: 'api_request',
  action: 'POST /api/invoices/create',
  resource: 'invoices',
  result: 'success',
  latency_ms: 127,
  metadata: {
    invoice_id: 'inv_9876',
    amount: 1500.00,
    currency: 'USD',
  },
});

const events = actions.map(action => ({
  agent_id: 'agid_acme_a1b2c3d4',
  event_type: 'tool_call',
  action: action.name,
  result: action.success ? 'success' : 'error',
  latency_ms: action.duration,
}));

const { ingested } = await vorim.emitBatch(events);
console.log(`${ingested} events recorded`);

const trust = await vorim.verify('agid_acme_a1b2c3d4');

console.log(trust.trust_score);    // 87
console.log(trust.status);         // 'active'
console.log(trust.owner.verified); // true — is the owning org verified
console.log(trust.active_scopes);  // ['agent:read', 'agent:execute']

trust = vorim.verify("agid_acme_a1b2c3d4")

print(trust.trust_score)      # 87
print(trust.status)           # 'active'
print(trust.owner["verified"]) # True — is the owning org verified

# Async (await needs an async function; run it with asyncio.run(main()))
async def main():
    async with AsyncVorim(api_key="agid_sk_live_...") as client:
        trust = await client.verify("agid_acme_a1b2c3d4")

// Sign a payload with the agent's private key
const payload = JSON.stringify({ action: 'transfer', amount: 500 });
const signature = await vorim.sign(payload, agent.private_key);

console.log(signature);
// 'ed25519:base64encodedSignature...'

// Include signature in audit events for verification
await vorim.emit({
  agent_id: agent.agent_id,
  event_type: 'api_request',
  action: 'POST /transfers',
  result: 'success',
  signature,  // Stored with the audit event
});

import { VorimError } from '@vorim/sdk';

try {
  await vorim.check('invalid_agent_id', 'agent:read');
} catch (err) {
  if (err instanceof VorimError) {
    console.log(err.status);   // 404
    console.log(err.code);     // 'AGENT_NOT_FOUND'
    console.log(err.message);  // 'Agent not found'
    console.log(err.details);  // { agent_id: 'invalid_agent_id' }
  }
}

import { commitPayload, hashPayload } from '@vorim/sdk';

// The key lives in your secret store and is never sent to Vorim.
const key = process.env.VORIM_COMMITMENT_KEY!;

await vorim.emit({
  agent_id: agent.agent_id,
  event_type: 'tool_call',
  action: 'invoice.refund',
  result: 'success',
  input_hash: await commitPayload(prompt, key),      // hmac-sha256:...
  output_hash: await commitPayload(completion, key),
});

import { commitPayload } from '@vorim/sdk';

// The auditor has the event, the prompt, and the key. They recompute.
const recomputed = await commitPayload(disclosedPrompt, disclosedKey);
console.log(recomputed === event.input_hash);  // true

const vorim = createVorim({
  apiKey: process.env.VORIM_API_KEY!,
  noPayload: true,                       // or { maxMetadataChars: 1024 }
});

await vorim.emit({
  agent_id: agent.agent_id,
  event_type: 'tool_call',
  action: 'invoice.refund',
  result: 'success',
  metadata: { tool: 'stripe.refunds.create', attempt: 2 },   // ok
});

await vorim.emit({
  agent_id: agent.agent_id,
  event_type: 'tool_call',
  action: 'invoice.refund',
  result: 'success',
  metadata: { prompt: fullPrompt },                          // throws
});
// VorimError PAYLOAD_BLOCKED — nothing was sent

const { events } = await vorim.emit({ /* ... */ });
// events: [{ event_id: 'evt_...', digest: 'sha256:...' }]

// Recompute it yourself, offline, from the event you sent.
import { eventDigest } from '@vorim/sdk';
console.log(await eventDigest(sentEvent) === events[0].digest);  // true

// Register a Google OAuth provider
await vorim.registerProvider({
  provider_key: 'google',
  display_name: 'Google Workspace',
  client_id: 'your-google-client-id',
  client_secret: 'your-google-client-secret',
  auth_url: 'https://accounts.google.com/o/oauth2/v2/auth',
  token_url: 'https://oauth2.googleapis.com/token',
  scopes_available: ['drive.readonly', 'gmail.send', 'calendar.events'],
});

// After user completes OAuth consent flow
await vorim.storeConnection({
  provider_id: 'provider-uuid',
  refresh_token: 'ya29.a0AfH6SM...',  // encrypted at rest
  scopes_granted: ['drive.readonly', 'gmail.send'],
  external_account_id: 'user@gmail.com',
});

// Give an agent access to a subset of the connection's scopes
await vorim.delegateCredential({
  connection_id: 'connection-uuid',
  agent_id: 'agid_acme_a1b2c3d4',
  scopes_delegated: ['drive.readonly'],  // must be ⊆ connection scopes
  max_requests_per_hr: 100,
  valid_until: '2027-04-30T00:00:00Z',
});

// Agent requests a short-lived access token
const token = await vorim.requestToken({
  agent_id: 'agid_acme_a1b2c3d4',
  scope: 'drive.readonly',
});

// Use the token (expires in ~1 hour)
const response = await fetch('https://www.googleapis.com/drive/v3/files', {
  headers: { Authorization: `${token.token_type} ${token.access_token}` },
});

// Revoke agent's access (cascades to all chains)
await vorim.revokeDelegation('delegation-uuid');

// Or revoke the entire connection (revokes ALL delegations)
// DELETE /v1/credentials/connections/:id

from vorim import Vorim

client = Vorim(api_key="agid_sk_live_...")

# Register provider
client.register_provider(
    provider_key="github",
    client_id="your-github-client-id",
    client_secret="your-github-client-secret",
    auth_url="https://github.com/login/oauth/authorize",
    token_url="https://github.com/login/oauth/access_token",
)

# Delegate to an agent
client.delegate_credential(
    connection_id="connection-uuid",
    agent_id="agid_acme_a1b2c3d4",
    scopes_delegated=["repo:read"],
)

# Agent requests a token
token = client.request_token(
    agent_id="agid_acme_a1b2c3d4",
    scope="repo:read",
)

// Register an ephemeral agent (auto-expires in 1 hour)
const result = await vorim.registerEphemeral({
  capabilities: ['data-processing', 'report-generation'],
  scopes: ['agent:read', 'agent:write'],
  ttl_seconds: 3600,  // 1 hour (min: 1, max: 86400)
});

console.log(result.did_key);     // did:key:z6Mkp...
console.log(result.ttl_seconds); // 3600
console.log(result.expires_at);  // ISO timestamp
console.log(result.private_key); // Ed25519 key (returned once)

from vorim import Vorim

client = Vorim(api_key="agid_sk_live_...")

# Register ephemeral agent (5-minute lifetime)
result = client.register_ephemeral(
    capabilities=["temp-task"],
    scopes=["agent:read", "agent:execute"],
    ttl_seconds=300,
)

print(result["did_key"])      # did:key:z6Mkp...
print(result["expires_at"])   # auto-expires in 5 minutes

POST https://your-endpoint.example.com/vorim
Content-Type: application/json
X-Vorim-Event: tool_call
X-Vorim-Timestamp: 2026-08-31T09:14:02.118Z
X-Vorim-Signature: sha256=9f2b...c41d

{
  "rule_id": "rule_7f3a2b",
  "rule_name": "Denied transactions",
  "event": {
    "event_type": "tool_call",
    "agent_id": "agid_acme_b5f35578",
    "action": "invoice.refund",
    "result": "denied"
  },
  "timestamp": "2026-08-31T09:14:02.118Z"
}

import { createHmac, timingSafeEqual } from 'node:crypto';

// You need the RAW body: a JSON round trip changes the bytes the MAC covers.
app.post('/vorim', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-Vorim-Timestamp') ?? '';
  const received  = req.get('X-Vorim-Signature') ?? '';

  const age = Math.abs(Date.now() - Date.parse(timestamp)) / 1000;
  if (!timestamp || Number.isNaN(age) || age > 300) return res.sendStatus(400);

  const expected = 'sha256=' + createHmac('sha256', process.env.VORIM_WEBHOOK_SECRET)
    .update(timestamp + '.' + req.body.toString('utf8'))
    .digest('hex');

  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  if (a.length !== b.length || !timingSafeEqual(a, b)) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString('utf8'));
  res.sendStatus(200);   // acknowledge fast, process out of band
});

POST /v1/audit/events         600 requests / minute
GET  /v1/audit/events         120 requests / minute
POST /v1/audit/export          10 requests / minute
POST /v1/runtime/decisions   5000 requests / minute
Webhook rule create/update     20 requests / minute

Auth endpoints are limited per IP, not per key:
  login                         10 attempts / 15 minutes
  register                       3 / hour
  password reset                 3 / hour

const vorim = createVorim({
  apiKey: process.env.VORIM_API_KEY,
  chainEvents: true,        // prev_event_hash on every event
  canonicalForm: 'v1',      // signature covers metadata and delegation too
  noPayload: true,          // refuse to transmit content at all
});

npx @vorim/verify bundle.json