TypeScript SDK

npm install veto-sdk

import { protect } from 'veto-sdk';

const safeTools = await protect(tools);

const safeTool = await protect(tool);

const safeTools = await protect(tools, { pack: 'financial' });
const safeToolsCloud = await protect(tools, { apiKey: 'veto_...' });
const safeToolsLog = await protect(tools, { mode: 'log' });
const safeToolsShadow = await protect(tools, { mode: 'shadow' });

import { Veto } from 'veto-sdk';

// Local mode (default — no API key needed)
const vetoLocal = await Veto.init();

// Cloud mode
const vetoCloud = await Veto.init({ apiKey: "veto_..." });

// Self-hosted mode
const vetoSelfHosted = await Veto.init({ endpoint: "https://veto.internal.corp.com" });

const wrappedForOpenAI = veto.wrap(openAITools);
const wrappedForAnthropic = veto.wrap(anthropicTools);
const wrappedForVercel = veto.wrap(vercelTools);
const wrappedForMCP = veto.wrap(mcpTools);

const safeTool = veto.wrapTool(myTool);

import { Veto, type GuardResult } from 'veto-sdk';

const veto = await Veto.init({ mode: 'log' });

const result: GuardResult = await veto.guard(
  'wire_transfer',
  { amount: 25000, recipient: 'vendor-123' },
  { sessionId: 'session-42', agentId: 'agent-7' }
);

if (result.decision === 'deny') {
  console.error(result.reason);
}

type GuardResult = {
  decision: 'allow' | 'deny' | 'require_approval';
  reason?: string;
  ruleId?: string;
  severity?: 'critical' | 'high' | 'medium' | 'low' | 'info';
  approvalId?: string;
  shadow?: boolean;
  shadowDecision?: string;
};

const stats = veto.getHistoryStats();
// { totalCalls: 5, allowedCalls: 4, deniedCalls: 1, ... }

veto.clearHistory();

import { ToolCallDeniedError } from 'veto-sdk';

try {
  await wrappedTool.invoke(args);
} catch (error) {
  if (error instanceof ToolCallDeniedError) {
    console.log(error.toolName);  // "transfer_funds"
    console.log(error.reason);    // "Amount 5000 exceeds limit of 1000"
    console.log(error.callId);    // "tc_abc123"
  }
}

import { BudgetExceededError } from 'veto-sdk';

try {
  await wrappedTool.invoke(args);
} catch (error) {
  if (error instanceof BudgetExceededError) {
    console.log(error.spent);     // 48.50
    console.log(error.limit);     // 50
    console.log(error.remaining); // 1.50
    console.log(error.toolName);  // "purchase"
    console.log(error.toolCost);  // 25
  }
}

import { ApprovalTimeoutError } from 'veto-sdk';

try {
  await wrappedTool.invoke(args);
} catch (error) {
  if (error instanceof ApprovalTimeoutError) {
    console.log(error.approvalId);  // "apr_abc123"
    console.log(error.timeoutMs);   // 300000
  }
}

const veto = await Veto.init({
  apiKey: "veto_...",
  onApprovalRequired: (context, approvalId) => {
    console.log(`Tool "${context.toolName}" needs approval: ${approvalId}`);
  },
});

validation:
  mode: "cloud"

cloud:
  apiKey: "veto_abc123..."
  baseUrl: "https://api.runveto.com"

approval:
  pollInterval: 2000   # ms between polls (default: 2000)
  timeout: 300000      # max ms to wait (default: 300000 = 5 min)

veto.setApprovalPreference('read_file', 'approve_all');
veto.setApprovalPreference('delete_database', 'deny_all');
veto.getApprovalPreference('read_file'); // "approve_all"
veto.clearApprovalPreferences('read_file');
veto.clearApprovalPreferences(); // Clear all

Agent calls tool
       │
       ▼
Check PolicyCache ─── cache miss ─── POST /v1/validate (server)
       │
  cache hit (deterministic, no session/rate constraints)
       │
       ▼
Run local validation
       │
       ├── allow ─── Tool executes
       │
       └── deny ─── ToolCallDeniedError
       │
  POST /v1/decisions (fire-and-forget)

import { VetoCloudClient } from 'veto-sdk';

const client = new VetoCloudClient({
  config: {
    apiKey: 'veto_abc123...',
    baseUrl: 'https://api.runveto.com',
    timeout: 30000,
    retries: 2,
    retryDelay: 1000,
  },
  logger,
});

const result = await client.validate('send_email', {
  to: 'user@example.com',
  subject: 'Hello',
});
// { decision: "allow" | "deny" | "require_approval", reason?, approval_id? }

const approval = await client.pollApproval('apr_abc123', {
  pollInterval: 2000,
  timeout: 300000,
});
// { id, toolName, status: "approved" | "denied" | "expired", resolvedBy? }

const policy = await client.fetchPolicy('send_email');
// { toolName, mode, constraints, sessionConstraints?, rateLimits?, version }

client.logDecision({
  tool_name: 'send_email',
  arguments: { to: 'user@example.com' },
  decision: 'allow',
  mode: 'deterministic',
  latency_ms: 2,
  source: 'client',
});

await client.registerTools([{
  name: 'send_email',
  description: 'Send an email',
  parameters: [
    { name: 'to', type: 'string', required: true },
    { name: 'subject', type: 'string', required: true },
    { name: 'body', type: 'string', required: true },
  ],
}]);

const json = veto.exportDecisions(); // JSON by default
const csv = veto.exportDecisions({ format: 'csv' });

import { toAnthropic, toOpenAI } from 'veto-sdk/providers/adapters';

const anthropicTools = toAnthropic(openAITools);
const openAITools = toOpenAI(anthropicTools);

import { fromMCP, isMCPTool } from 'veto-sdk/providers';

if (isMCPTool(tool)) {
  const normalized = fromMCP(tool);
}