ZeroLeaks Developer Documentation
Integrate hosted AI red-team scans, runtime prompt defenses, or the open-source ZeroLeaks scan engine.
ZeroLeaks Developer Documentation
ZeroLeaks gives developers three complementary ways to secure AI applications: a hosted scanning SDK, a lightweight runtime Shield SDK, and the open-source zeroleaks scan engine.
Choose a product
ZeroLeaks SDK
Connect hosted attacks to your real AI SDK, OpenAI, custom, or HTTP agent. Preserve tools, memory, middleware, and multi-turn behavior.
Shield SDK
Add local, low-latency prompt hardening, injection detection, and output sanitization to an LLM application.
zeroleaks package
Run the open-source scanner and CLI locally with your own model provider credentials.
How they fit together
| Product | Best for | Runs where | Credential |
|---|---|---|---|
@zeroleaks/sdk | Production-fidelity runtime, endpoint, prompt, and skill scans | ZeroLeaks orchestration plus your runner | ZEROLEAKS_API_KEY |
@zeroleaks/shield | Runtime protection in an LLM request path | Your application | None for core features |
zeroleaks | Local scans, research, and custom scan engines | Your machine or CI runner | OPENROUTER_API_KEY |
For most production applications, use SDK runtime scans to exercise the real agent and Shield for runtime defense in depth. Use the zeroleaks package when you need local control over the scanning engine.
Security note
ZeroLeaks API keys are server credentials. Keep them in a server-side environment variable or secret manager and never include them in browser bundles, mobile applications, source control, or logs.