QUICK START

Observe supported agent actions in minutes. Enforce approved policies when you're ready.

Install the CLI, point it at your workspace, and start capturing governance decisions — no changes to your existing agent framework required.

Operator handoff

Have your agent set up Spctre.

Paste one request into your coding agent. It installs the CLI, starts a free trial, and wires up observe mode — pausing once for you to approve it in the browser. No account or credit card needed up front.

No credentials or secrets are included.

Initial setup

3 steps

Install the CLI

npm install -g @spctre/cli

Connect to your Spctre workspace

No workspace yet? The first command starts a free trial — the approval page creates your account if you don't have one, and no credit card is involved. Already have a workspace? Use the second. Either way a browser tab opens for one-time approval, and access tokens rotate automatically from then on.

# New to Spctre — starts a free trial
spctre cloud login --trial \
  --url https://app.spctre.dev \
  --agent my-agent

# Already have a workspace
spctre init \
  --url https://app.spctre.dev \
  --agent my-agent

# Verify the connection and token
spctre status --check

Start the policy watcher

The watcher keeps your local policy bundle in sync with your workspace and sends regular heartbeats. Without it, agents run against a stale bundle. Then choose your integration below.

spctre watch --heartbeat

Agent CLI integrations

Claude · Codex · Gemini · Antigravity

Install governance hooks and policy skills for your AI agent CLI. Hooks capture audit logs and check policy on every tool call. Skills give agents policy-aware operating instructions.

# Governance hook — captures audit logs, warns on DENY (observe mode)
spctre install-hook --claude --mode observe

# Policy skill — gives Claude policy-aware operating instructions
spctre install-skill --claude

# Upgrade to enforce mode to block on DENY (requires human approval)
spctre install-hook --claude --enforce

# Apply globally across all projects
spctre install-hook --claude --mode observe --global
spctre install-skill --claude --global

Writes the PreToolUse hook to .claude/settings.json and the skill to .claude/skills/spctre/.

# Governance hook — captures audit logs, warns on DENY (observe mode)
spctre install-hook --codex --mode observe

# Policy skill — gives Codex policy-aware operating instructions
spctre install-skill --codex

# Upgrade to enforce mode
spctre install-hook --codex --enforce

# Apply globally
spctre install-hook --codex --mode observe --global
spctre install-skill --codex --global

Writes the PreToolUse hook to .codex/hooks.json and the skill to .codex/skills/spctre/.

# Governance hook — captures audit logs, warns on DENY (observe mode)
spctre install-hook --gemini --mode observe

# Policy skill — gives Gemini policy-aware operating instructions
spctre install-skill --gemini

# Upgrade to enforce mode
spctre install-hook --gemini --enforce

# Apply globally
spctre install-hook --gemini --mode observe --global
spctre install-skill --gemini --global

Writes the BeforeTool hook to .gemini/settings.json and the skill to .gemini/skills/spctre/, referenced from GEMINI.md.

# Governance hook — captures audit logs, warns on DENY (observe mode)
spctre install-hook --antigravity --mode observe

# Policy skill — gives the agent policy-aware operating instructions
spctre install-skill --antigravity

# Upgrade to enforce mode
spctre install-hook --antigravity --enforce

# Apply globally
spctre install-hook --antigravity --mode observe --global
spctre install-skill --antigravity --global

One install covers both the Antigravity IDE and the agy CLI. Locally, Spctre writes its hook to .agents/hooks.json and its skill to .agents/skills/spctre/ — both auto-read, with no plugin staging. With --global, the hook goes to ~/.gemini/config/hooks.json and the skill to ~/.gemini/antigravity-cli/plugins/spctre/.

For the separate google-antigravity Python SDK, use spctre watch --framework antigravity-sdk. That adapter governs SDK ToolRunner calls; it does not govern agy.

Agent framework integrations

Stack-neutral

Send governance decisions from any agent framework using the SDK or REST API. Set runtimeTarget.stack to identify the source runtime — it's recorded with every decision and policy provenance chain.

# Zero-code framework watch — wraps OpenAI Agents events automatically
spctre watch --framework openai-agents

# Or ingest decisions directly:
import { createSpctreClient } from "@spctre/sdk";

const client = createSpctreClient({
  baseUrl: "https://app.spctre.dev/api/v1",
  token: process.env.SPCTRE_TOKEN!,
});

await client.POST("/evidence", {
  body: {
    decisionId: "decision-001",
    environment: "production",
    runtimeTarget: { stack: "OPENAI_AGENTS" },
    agentId: "support-agent",
    connector: "stripe",
    action: "refund.create",
    status: "DENY",
    reason: "Requires manager approval.",
  },
});

# Zero-code framework watch — wraps Bedrock agent events automatically
spctre watch --framework bedrock

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "bedrock-decision-001",
    environment: "production",
    runtimeTarget: { stack: "AWS_BEDROCK", adapter: "agt-bedrock" },
    agentId: "bedrock-agent",
    connector: "dynamodb",
    action: "item.write",
    status: "ALLOW",
  },
});

# Zero-code framework watch — wraps Google ADK events automatically
spctre watch --framework google-adk

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "adk-decision-001",
    environment: "production",
    runtimeTarget: { stack: "GOOGLE_ADK" },
    agentId: "adk-agent",
    action: "tool.call",
    status: "ALLOW",
  },
});

# Zero-code framework watch — wraps LangChain / LangGraph events automatically
spctre watch --framework langchain

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "lc-decision-001",
    environment: "production",
    runtimeTarget: { stack: "LANGCHAIN" },
    agentId: "langchain-agent",
    connector: "postgres",
    action: "query.write",
    status: "ALLOW",
  },
});

# Zero-code framework watch — wraps Azure AI / Azure OpenAI events automatically
spctre watch --framework azure-ai

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "azure-decision-001",
    environment: "production",
    runtimeTarget: { stack: "AZURE_AI" },
    agentId: "azure-agent",
    connector: "blob-storage",
    action: "blob.write",
    status: "DENY",
    reason: "Write access not permitted in production.",
  },
});

# Zero-code framework watch — wraps CrewAI events automatically
spctre watch --framework crewai

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "crew-decision-001",
    environment: "production",
    runtimeTarget: { stack: "CREWAI" },
    agentId: "crew-agent",
    connector: "email",
    action: "email.send",
    status: "DENY",
    reason: "External email requires approval.",
  },
});

# Zero-code framework watch — wraps AutoGen events automatically
spctre watch --framework autogen

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "autogen-decision-001",
    environment: "production",
    runtimeTarget: { stack: "AUTOGEN" },
    agentId: "autogen-agent",
    connector: "code-executor",
    action: "code.execute",
    status: "DENY",
    reason: "Code execution blocked by workspace policy.",
  },
});

# Zero-code framework watch — wraps Strands agent events automatically
spctre watch --framework strands

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "strands-decision-001",
    environment: "production",
    runtimeTarget: { stack: "STRANDS" },
    agentId: "strands-agent",
    action: "tool.call",
    status: "ALLOW",
  },
});

# Zero-code framework watch — wraps Gemini tool-call events automatically
spctre watch --framework gemini

# Or ingest decisions directly:
await client.POST("/evidence", {
  body: {
    decisionId: "gemini-decision-001",
    environment: "production",
    runtimeTarget: { stack: "GEMINI" },
    agentId: "gemini-agent",
    action: "tool.call",
    status: "ALLOW",
  },
});

Install: npm install @spctre/sdk. Every decision is recorded with its policy provenance — branch, revision, artifact hash, and runtime target.

spctre watch --framework also accepts claude-agent-sdk, notion-worker, omnigent, antigravity-sdk, and local-custom for internal or proprietary runtimes. Run spctre verify-env --framework <name> to confirm an adapter is wired correctly before you rely on it.

Framework-native plugins are also published for runtimes with their own middleware contracts: pip install spctre-hermes (Hermes pre_tool_call hooks) and pip install spctre-odysseus (Odysseus ToolMiddleware).

Author locally, import for review

Operator & CI

Keep policy and agent Blueprint sources in your own repository and import them from CI with an operator service key. Both commands are idempotent and always land as a draft for review — neither one approves or publishes anything on its own.

# Import a local policy file as a draft branch
spctre policy import policies/refunds.yaml \
  --connector stripe \
  --branch payments/refund-review \
  --key $SPCTRE_CI_KEY

# Scope a branch to an environment instead of a connector
spctre policy import policies/prod-guardrails.yaml \
  --scope ENVIRONMENT \
  --environment production \
  --key $SPCTRE_CI_KEY

Requires a service key carrying the policy:import scope. The revision records the source path as provenance, so a published rule can be traced back to the file and commit it came from. Re-running the same import updates the existing draft rather than creating a duplicate.

# Validate a Blueprint source without touching the control plane
spctre blueprint import blueprints/support-agent.yaml --dry-run

# Import it as a draft Blueprint for review
spctre blueprint import blueprints/support-agent.yaml \
  --key $SPCTRE_CI_KEY

Requires a service key carrying the blueprint:import scope. A Blueprint declares what one agent is allowed to do — its permitted tasks, tools, connectors, budgets, approvals, and runtime targets — and goes through the same review and publish path as a policy revision.

Gateway & SDK

TypeScript SDK · Python SDK · REST · MCP

Ingest audit logs through SDK, REST, MCP, or configured JSON, CloudEvents, NDJSON, and OTLP evidence mappings. Fetch policy bundles and request real-time gateway decisions via SDK, REST, or MCP server. Spctre preserves end-to-end provenance for each accepted governance record.

import { createSpctreClient } from "@spctre/sdk";

const client = createSpctreClient({
  baseUrl: "https://app.spctre.dev/api/v1",
  token: process.env.SPCTRE_TOKEN!,
});

// Ingest a governance decision
const { data } = await client.POST("/evidence", {
  body: {
    decisionId: "decision-001",
    environment: "production",
    runtimeTarget: { stack: "OPENAI_AGENTS" },
    agentId: "support-agent",
    connector: "stripe",
    action: "refund.create",
    status: "DENY",
    reason: "Requires manager approval.",
  },
});

// Fetch the active policy bundle
const { data: bundle } = await client.GET("/bundle/latest", {});

// Request a gateway decision
const { data: decision } = await client.POST("/gateway/decide", {
  body: {
    decisionId: "decision-001",
    artifactHash: bundle.artifactHash,
    policyContext: bundle.policyContext,
  },
});

Fully typed against the OpenAPI 3.1 spec. Install: npm install @spctre/sdk

pip install spctre-sdk

import os

from spctre import SpctreClient

client = SpctreClient(
    base_url="https://app.spctre.dev",
    token=os.environ["SPCTRE_TOKEN"],
)

# Work through stable product-domain clients
bundle = client.bundle.latest()

The Python SDK provides stable, typed clients for gateway decisions, evidence, policy, trust, verification, bundles, compliance, and approvals. Its generated OpenAPI bindings remain available under spctre._generated for endpoints the facade does not yet cover.

# Ingest a governance decision
curl -X POST https://app.spctre.dev/api/v1/evidence \
  -H "Authorization: Bearer $SPCTRE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "decisionId": "decision-001",
    "environment": "production",
    "runtimeTarget": {"stack": "LOCAL"},
    "agentId": "my-agent",
    "connector": "stripe",
    "action": "refund.create",
    "status": "DENY",
    "reason": "Requires manager approval."
  }'

# Fetch the active policy bundle
curl https://app.spctre.dev/api/v1/bundle/latest \
  -H "Authorization: Bearer $SPCTRE_TOKEN"

# Export a compliance packet
curl https://app.spctre.dev/api/v1/compliance/export \
  -H "Authorization: Bearer $SPCTRE_TOKEN"

OpenAPI 3.1 spec at /api/v1/openapi.json. Required scopes: evidence:write, bundle:read, compliance:read.

{
  "mcpServers": {
    "spctre": {
      "command": "npx",
      "args": ["@spctre/mcp-server"],
      "env": {
        "SPCTRE_API_URL": "https://app.spctre.dev",
        "SPCTRE_WORKSPACE_ID": "your-workspace-id",
        "SPCTRE_API_TOKEN": "your-access-token",
        "SPCTRE_API_REFRESH_TOKEN": "your-refresh-token"
      }
    }
  }
}

Core tools include evaluate_policy, create_evidence_record, get_effective_policy, get_compliance_status, and ingest_gateway_event. Supports STDIO and stateless Streamable HTTP transport. Token rotation is handled automatically.