ArmorIQ SDK

Build secure AI agents with cryptographic intent verification.

The ArmorIQ SDK enables developers to build AI agents with built-in security and auditability. Just one API key - no cloud complexity.

Why ArmorIQ?

• Simple - Just one API key, no cloud credentials
• Secure - Cryptographic verification for every action
• Auditable - Complete execution trail
• Fast - Get started in 5 minutes

Installation

pip install armoriq-sdk

CLI commands are also available after install:

armoriq --help

Quick Start

1. Get Your API Key

Visit platform.armoriq.ai to generate your API key.

2. Initialize the Client

from armoriq_sdk import ArmorIQClient

client = ArmorIQClient(
    api_key="ak_your_key_here",
    user_id="your-user-id",
    agent_id="your-agent-id"
)

Or load SDK settings from armoriq.yaml generated by the CLI:

from armoriq_sdk import ArmorIQClient

client = ArmorIQClient.from_config("armoriq.yaml")

3. Capture Your Plan

plan = {
    "goal": "Get weather forecast",
    "steps": [
        {
            "action": "get_weather",
            "tool": "weather_api",
            "inputs": {"city": "Boston"}
        }
    ]
}

plan_capture = client.capture_plan(
    llm="gpt-4",
    prompt="What's the weather in Boston?",
    plan=plan
)

4. Get Intent Token

token = client.get_intent_token(plan_capture)

5. Invoke Actions

result = client.invoke(
    mcp_name="weather-mcp",
    action="get_weather",
    intent_token=token,
    inputs={"city": "Boston"}
)

print(result)

Observability

The SDK emits one native OpenTelemetry span tree per agent run — traces, model calls, policy decisions, and tool/command execution — exported over OTLP protobuf. There is no separate JSON telemetry pipeline and no pipeline selector to configure; native OTel is the only path.

Choose one of three exporter destinations via ObservabilityOptions:

from armoriq_sdk import ArmorIQClient
from armoriq_sdk.models import ObservabilityOptions

# 1. ArmorIQ OTLP (default) — spans go to the ArmorIQ backend's
#    POST /v1/traces receiver, authenticated with your API key.
client = ArmorIQClient(
    api_key="ak_your_key_here",
    observability=ObservabilityOptions(exporter="armoriq"),
)

# 2. Generic external OTLP — send spans to any OTLP/HTTP collector
#    (an OpenTelemetry Collector, Langfuse, etc).
client = ArmorIQClient(
    api_key="ak_your_key_here",
    observability=ObservabilityOptions(
        exporter="external",
        endpoint="https://otel-collector.example.com/v1/traces",
    ),
)

# 3. Caller-owned tracer provider — the SDK uses your existing
#    TracerProvider and never mutates or shuts it down. Because the SDK
#    cannot attach its export-time policy re-check to a pipeline it does
#    not own, this mode is capped at `metadata`: prompts, completions,
#    tool arguments and tool results are never captured, whatever your
#    organization's lease allows.
client = ArmorIQClient(
    api_key="ak_your_key_here",
    observability=ObservabilityOptions(
        exporter="provider",
        tracer_provider=my_tracer_provider,
    ),
)

Per-session opt-out, without changing the exporter, via SessionOptions.observability_enabled=False.

Capture depth (off, metadata, enhanced, debug) is bounded by your organization's policy first; local settings can only lower it, never raise it. exporter="provider" lowers it further, to metadata at most.

Breaking change (0.7.0): the legacy in-memory JSON recorder/shipper pipeline, ObservabilityOptions.pipeline, and the ARMORIQ_OTEL_PIPELINE env var are removed. See CHANGELOG.md for the full list of removed APIs and their replacements.

Documentation

For complete documentation, visit docs.armoriq.ai

• Framework adapter compatibility — tested Python framework versions, lifecycle hooks, and limits for the zero-touch OpenTelemetry adapters.

Links

• armoriq.ai
• docs.armoriq.ai
• platform.armoriq.ai

License

MIT License - see LICENSE file for details.