ZeroLeaks
ZeroLeaks SDK

OpenAI Integration

Scan OpenAI Responses API and Chat Completions agents with native request options and executable function tools.

OpenAI Integration

import OpenAI from "openai";
import { ZeroLeaks } from "@zeroleaks/sdk";
import { openAI } from "@zeroleaks/sdk/openai";

const client = new OpenAI();
const zeroleaks = new ZeroLeaks();

Responses API

const target = openAI.responses({
  client,
  request: {
    model: "gpt-5",
    instructions: SUPPORT_INSTRUCTIONS,
    tools: [
      {
        type: "function",
        name: "lookup_customer",
        description: "Read a customer profile",
        parameters: {
          type: "object",
          properties: { id: { type: "string" } },
          required: ["id"],
          additionalProperties: false,
        },
        strict: true,
      },
      { type: "web_search" },
    ],
  },
  toolExecutors: {
    lookup_customer: ({ id }) => lookupCustomer(String(id)),
  },
});

await zeroleaks.runtimeScans.run(target);

The adapter follows function_call items with function_call_output items until the response completes. Provider-executed tools such as web search are also included in the trace.

Chat Completions

const target = openAI.chatCompletions({
  client,
  request: {
    model: "gpt-5",
    tools: [
      {
        type: "function",
        function: {
          name: "lookup_customer",
          description: "Read a customer profile",
          parameters: {
            type: "object",
            properties: { id: { type: "string" } },
            required: ["id"],
          },
        },
      },
    ],
  },
  toolExecutors: {
    lookup_customer: ({ id }) => lookupCustomer(String(id)),
  },
});

The adapter runs the assistant/tool-message loop until the model produces a final response.

Tool errors

By default, executor errors are returned to the model as tool outputs and recorded in the report. Set toolErrorMode: "throw" when your production loop terminates immediately on tool failure.

For custom OpenAI orchestration, streaming event handling, Agents SDK code, or application-specific memory, wrap your existing production handler with createRuntimeTarget() instead. That path preserves your implementation exactly.

On this page