conseel

Drop-in encrypted transport for AI SDKs. Wraps cohere-tng to route requests through OHTTP encryption with TEE attestation verification. TNG automatically promotes the model field from JSON request bodies into an x-gateway-model-name header for backend routing (via body_field_headers config).

Install

pip install conseel

Usage

Cohere

import cohere
import httpx
from conseel import Transport

co = cohere.ClientV2(
    api_key="...",
    httpx_client=httpx.Client(transport=Transport()),
)
co.chat(model="command-a-plus-05-2026", messages=[...])

OpenAI

from openai import OpenAI
import httpx
from conseel import Transport

client = OpenAI(
    http_client=httpx.Client(transport=Transport()),
)
client.chat.completions.create(model="gpt-4", messages=[...])

Async

import httpx
from conseel import AsyncTransport

async with httpx.AsyncClient(transport=AsyncTransport()) as client:
    resp = await client.post(url, json={"model": "command-a-plus-05-2026", ...})

What it does

1. Encrypts all traffic via OHTTP so that even the network infrastructure cannot inspect request or response payloads.
2. Verifies the remote TEE before sending any data, accepting either an Intel Trust Authority passport or a background-check appraisal against the latest signed integritee policy release (configurable via verify).
3. Promotes the model field from JSON request bodies to the x-gateway-model-name HTTP header for gateway routing. This happens inside TNG via body_field_headers config. Body parsing is skipped entirely for non-JSON requests (e.g. multipart audio uploads) and when the target headers are already present on the request.
4. Forwards authorization and x-gateway-model-name headers through the OHTTP layer to the backend.

Configuration

Transport and AsyncTransport accept the same verify and ohttp keyword arguments as cohere_tng.Transport (see TNG configuration docs for the full schema). The only difference is that conseel provides sensible defaults:

• verify — Defaults to Intel Trust Authority attestation. Accepts one config dict or a list of them. Defaults to a list of two verifiers: Intel Trust Authority passport, and the builtin attestation service in background-check mode fetching trustee_policy from the latest integritee release. Pass a single object to allow only one, or None to disable verification (not recommended for production).
• ohttp — Defaults include forwarding authorization headers and promoting the model JSON body field to x-gateway-model-name via body_field_headers.