EVE for AI Engineering Teams

For engineers building agentic systems who need a governance layer that is deterministic, fails closed, and produces evidence they can verify in their own tests.

The problem

Shipping an agent that can call tools means owning a new failure mode: the model does something it should not, and you have no reproducible record of the control decision. You want a boundary that is deterministic, testable, and easy to wire in without adding a model call to the hot path.

How EVE helps

• One call, one decision. Route a tool call through EVE and get a deterministic ALLOW / BLOCK / MODIFY decision before the tool executes. No LLM is in the decision path, so the boundary is reproducible in unit tests.
• Fail-closed by design. EVE supports embedded (in-service), hosted, sidecar, MCP-gateway, and sovereign/offline modes. In every mode, a service error fails closed — no SDK silently falls back to permissive behavior.
• Evidence you can assert on. Each decision can produce a signed evidence record; verify it offline in Python, Node, or the browser and assert on it in your test suite.
• Low overhead on the governed path. In the release-candidate benchmarks, Python embedded governance measured p50 10.8 ms / p95 15.7 ms / p99 17.0 ms (CoreGuard-dominated; SDK overhead ≈ 0); evidence verification measured well under a millisecond (Python p50 0.22 ms, TypeScript p50 0.071 ms). Hosted round-trip latency is network-bound.

SDK entry points

Python (eve-coreguard 0.2.2):

from eve_coreguard import EVE

# hosted mode requires a reachable endpoint and an API key
eve = EVE(mode="hosted", endpoint="https://<your-eve-endpoint>", api_key="eve_sk_...")
result = eve.govern_tool_call(
    tool="send_email",
    arguments={"to": "ops@example.com", "body": "synthetic fixture"},
    context={"tenant_id": "acme", "principal_id": "svc-agent", "session_id": "sess-123"},
)
if result["action"] == "BLOCK":
    ...  # do not execute the tool

TypeScript (@eve/coreguard 0.1.0-rc1, ESM, Node >= 18):

import { EVE } from "@eve/coreguard";

// hosted mode; TS never signs and holds no secrets
const eve = new EVE({ mode: "hosted", endpoint: "https://<your-eve-endpoint>", apiKey: "eve_sk_..." });
const result = await eve.governToolCall({
  tool: "send_email",
  arguments: { to: "ops@example.com", body: "synthetic fixture" },
  context: { tenantId: "acme", principalId: "svc-agent", sessionId: "sess-123" },
});

Verify signed evidence independently (verify_decision_record in Python, verifyEvidence in TypeScript/browser) using the Ed25519 public key — no production credentials required.

Adapters

The generic adapter routes tool calls through the shared governance composition root and is validated. Adapters for OpenAI Agents, Claude Agent SDK, LangChain, LangGraph, CrewAI, and Vercel AI SDK are structurally implemented but experimental — not yet validated against pinned live framework versions.

Readiness

• EVE SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS.
• The Python and TypeScript clients are release-candidate core clients, distributed privately for pilots — install the pilot artifact, not a public pip/npm install (see readiness for public-registry status).
• Signed evidence and offline verification are SUPPORTED; the generic adapter is supported.
• Framework adapters other than the generic adapter are experimental.

Limitations

• The pip client governs via hosted mode (requires a reachable endpoint); embedded in-process governance is the EVE service, not the client wheel. In TypeScript, embedded mode is unsupported and raises SDK_TS_EMBEDDED_UNSUPPORTED.
• Independent verification requires the Ed25519 public key; the HMAC fallback is symmetric and not independently verifiable.
• Wrapper-enforced adapters are bypassable by a direct call to the underlying tool; cooperative hooks are a cooperative boundary, not a hard enforcement point. Hard enforcement requires a gateway or sidecar.
• Benchmarks are warm-path measurements from the release-candidate report; your latency will vary with deployment mode and network.
• jcs-1 is a constrained RFC 8785 profile: it fails closed on non-integer floats / NaN / Infinity and is not full float compliance.