How It Works

Two ways in.

Instrument your agents with the SDK, or route your MCP traffic through the Cyphrex gateway. Same enforcement, same evidence.

Path 1

The SDK

Instrument your agents in code. This is the primary path. One check before every action, across MCP, REST, databases, and framework native tools.

01

Install and check

One npm install. One check() call before every agent action. Cyphrex enforces your behavior profile in real time and blocks unsafe actions before execution.

02

Log responses

Every LLM response and tool call flows through Cyphrex for spend tracking, output safety, and PII detection. Zero manual logging.

03

Export signed evidence

Generate cryptographically signed compliance reports on demand. SOC 2, EU AI Act, HIPAA, SR 11-7 (superseded by SR 26-2, April 2026), and SR 26-2 mapped per agent action.

SDK INTEGRATION

import { Cyphrex } from 'cyphrex';

const cyphrex = new Cyphrex({
  apiKey: 'cprx_live_...',
  agentId: '...'
});

// Step 1: check before every LLM call
const check = await cyphrex.check({
  actionType: 'http_call',
  url: 'api.openai.com/v1/chat'
});
if (!check.allowed) return;

// Step 2: your normal LLM call
const response = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages
});

// Step 3: automatic cost tracking
await cyphrex.check({
  actionType: 'llm_response',
  payload: response
});

Path 2

The MCP gateway

Point your agent's MCP traffic at Cyphrex. No code changes. Same enforcement, same evidence.

01

Point MCP traffic at Cyphrex

Point your agent's MCP traffic at Cyphrex, no code changes. Authenticate with an Authorization Bearer header on the MCP session.

02

Check before the call leaves

Every tool call is checked against your policy before it leaves.

03

Block malicious servers

Malicious upstream servers are blocked before the request is made.

04

Withhold poisoned tools

Poisoned tool definitions are withheld, not passed through with a warning.

05

Same audit trail

Everything is recorded to the same tamper evident audit trail.

The gateway covers MCP traffic. Agents also call REST APIs, databases, and framework native tools, which is what the SDK covers. Most deployments use both.

Message the founder