Documentation

curl -X POST \
  https://csclite.dev/api/v1/evaluate \
  -H "Authorization: Bearer csc_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"intent": "Delete all user data"}'

{
  "decision": {
    "id": "a3f2c8d1-...",
    "verdict": "DENY",
    "riskScore": 25,
    "requiresFounder": false,
    "allowActions": [],
    "denyActions": ["DATA_WRITE", "DATA_DELETE"],
    "pipelineTrace": [
      { "stage": "MCM", "summary": "...", "durationMs": 2 },
      { "stage": "RFE", "summary": "...", "durationMs": 1 },
      // ... SPS, SEG, FOP
    ]
  },
  "policyHash": "sha256-...",
  "meta": { "latencyMs": 12, "tier": "pro", "usage": 42, "limit": 50000 }
}

# POST to your webhook URL on approve/deny
{
  "event": "decision.approved",
  "decisionId": "a3f2c8d1-...",
  "actor": "agent-1",
  "action": "Deploy to production",
  "verdict": "APPROVE",
  "riskScore": 72,
  "timestamp": "2026-02-22T12:00:00Z"
}

import { createHmac } from "node:crypto";

function verifyWebhook(body: string, sig: string, secret: string) {
  const expected = createHmac("sha256", secret)
    .update(body).digest("hex");
  return sig === `sha256=${expected}`;
}

// Check the X-CSC-Signature header
const sig = req.headers["x-csc-signature"];
if (!verifyWebhook(rawBody, sig, process.env.WEBHOOK_SECRET!)) {
  return new Response("Invalid signature", { status: 401 });
}

npm install -g @csc-lite/mcp-server

// ~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "csc-lite": {
      "command": "csc-lite-mcp",
      "env": {
        "CSC_API_KEY": "csc_live_YOUR_KEY"
      }
    }
  }
}

pip install csc-lite

from csc_lite import CSCClient

csc = CSCClient(api_key="csc_live_...")

result = csc.evaluate("Delete all user data")
print(result.decision.verdict)     # "DENY"
print(result.decision.risk_score)  # 85

from csc_lite import CSCAsyncClient

async with CSCAsyncClient(api_key="csc_live_...") as csc:
    result = await csc.evaluate("Send payment")
    if result.decision.verdict == "APPROVE":
        print("Safe to proceed")

from csc_lite import CSCClient

csc = CSCClient(api_key=os.environ["CSC_API_KEY"])

def governed_tool_call(tool_name: str, tool_input: str):
    result = csc.evaluate(
        f"{tool_name}: {tool_input}",
        actions=[tool_name],
    )
    if result.decision.verdict == "APPROVE":
        return "approved"  # proceed with tool
    return "denied"      # block the tool call

class GovernedAgent:
    def __init__(self, name, role):
        self.name = name
        self.role = role

    def execute(self, task):
        result = csc.evaluate(
            f"[{self.role}] {task}",
            actions=[self.role.lower().replace(" ", "_")],
        )
        return {  # use verdict to gate execution
            "verdict": result.decision.verdict,
            "risk": result.decision.risk_score,
        }

# Usage with CrewAI callback
agent = GovernedAgent("analyst", "Research Analyst")
result = agent.execute("Analyze user behavior data")

import { CSCClient } from "@csc-lite/sdk";

const csc = new CSCClient({ apiKey: process.env.CSC_API_KEY! });

async function executeFunction(name: string, args: object) {
  const result = await csc.evaluate({
    intent: `{name}: {JSON.stringify(args)}`,
    actions: [name],
  });

  if (result.decision.verdict !== "APPROVE") {
    throw new Error(`Blocked: {result.decision.verdict}`);
  }
  // safe to call the actual function
}