Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

@keeptrusts/agent 0.1.0 evaluation

:::danger This is not a quickstart

Version 0.1.0 cannot provide a supported Node.js onboarding path. This unlisted page is retained only as an evaluation checklist. Start new work with the supported TypeScript Agent Workflow.

:::

There is no honest plain Node.js quickstart for @keeptrusts/agent 0.1.0. A cleanly built package throws during a normal Node.js import, and several high-level helpers do not match current API routes or response bodies.

Use the supported TypeScript Agent Workflow to send governed traffic and correlate the request with a real event.

What an evaluation should prove​

Before adopting a later SDK release, verify all of these behaviors against the real product rather than package mocks:

  1. The built package imports in the documented server runtime without special test aliases.
  2. The control-plane bearer token and gateway request token are passed as separate values.
  3. An agent can be created and read through the live /v1/agents routes.
  4. A gateway request carries one UUID x-request-id and the intended x-keeptrusts-agent-id.
  5. /v1/events returns the matching event when queried with required since, agent_id, and the gateway's canonical request ID. For a UUID transport ID, that event value is the same 32 hexadecimal characters without hyphens.
  6. Event code reads the live { "events": [...] } wrapper and the event_id, timestamp, event_attribution, and event_cost_attribution fields.
  7. Trail verification uses a time window and does not claim a nonexistent per-event digest association.
  8. MCP uses streamable-HTTP JSON-RPC at /mcp, including initialization and session handling.

Current 0.1.0 blockers​

The package's own unit tests mock HTTP responses with shapes that differ from the API and replace the throwing server-only dependency. Consequently, npm run test and npm run build can pass while the public quickstart still cannot run.

Do not use Node's react-server condition as an undocumented production workaround. Although it changes which server-only file resolves, 0.1.0 does not provide a verified framework integration or end-to-end contract under that condition.

Credential checklist​

Prepare these separately for the supported direct workflow:

  • KEEPTRUSTS_CONTROL_PLANE_TOKEN for authenticated API reads and writes;
  • KEEPTRUSTS_GATEWAY_TOKEN for model requests to the gateway;
  • an upstream provider credential configured at the gateway, not in the agent application;
  • a Keeptrusts API token for a published MCP endpoint when MCP is used.

The first three represent different trust boundaries. Do not move any of them into browser code.

Next steps​