SDKs
The AnonRouter SDKs for verifying confidential routes, running E2EE inference, and generating images and speech across the two-origin privacy split. Source and release artifacts are on GitHub; the registry packages are not published yet.
AnonRouter is OpenAI-compatible, so you can reach most of it with any HTTP client or OpenAI SDK. These packages are for the parts a stock client cannot do:
- check the provider evidence yourself, rather than taking our word for a confidentiality claim;
- encrypt requests in your own process, so AnonRouter only ever holds ciphertext; and
- run the two-origin ticket exchange for images and speech, which needs two hosts and two different credentials in one logical call.
Where to get it: GitHub, not npm or PyPI
The source, the reviewed measurement pins, the shared test vectors, and
checksummed release artifacts are public at
anonrouter/anonrouter-sdk
under Apache-2.0, released as
v0.1.0.
Neither registry carries the packages yet. npm install @anonrouter/confidential and pip install anonrouter-confidential both fail
today; install from the release artifacts or a clone until the registry
publication lands.
Packages
| Package | Language | What it is |
|---|---|---|
@anonrouter/confidential | JavaScript / TypeScript | Verify both hops, run E2EE inference, and generate images and speech. Installs the anonrouter-verify command. |
anonrouter-confidential | Python | The twin of the above: same verification, same E2EE, same media surface, same shared test vectors. |
@anonrouter/client | JavaScript / TypeScript | A thin, dependency-free client for the public chat and models API over the ticketed flow. |
Install from the release, not from a registry
The v0.1.0 release publishes both npm tarballs, the Python wheel and sdist,
the reproducible linux/amd64 DCAP verifier with its source, and a
SHA256SUMS covering all seven. Verify the checksums and install the artifact
directly. The npm install and pip install commands on the package pages
start working only once the registry publication happens.
Verification and E2EE
Verify both hops with one verdict you can gate on, and run end-to-end-encrypted inference.
Images and speech
client.images.generate and client.audio.speech.create over the two-origin ticket exchange.
anonrouter-verify
The command both packages install. Exits nonzero unless the assurance you asked for was established, so it can gate a deploy.
Why an installed SDK is a stronger trust boundary
For browser-encrypted chat, AnonRouter serves the JavaScript that does the encryption. That is convenient, but it means trusting code we deliver at request time. A package you install yourself, pin to a version, and audit is a stronger boundary: AnonRouter cannot swap it per request. If you are building a desktop app, a backend service, or anything where verification must not depend on us, use the SDK rather than the browser flow.
What these SDKs claim, and what they do not
- They re-verify raw evidence themselves. The gateway's own verdict is returned for comparison and is never trusted in its place.
- They report an honest ceiling, per hop. AnonRouter's own confidential plane
(hop 1) can reach
hardware_verified, but only with a real DCAP engine that actually chained the quote to Intel's roots. The provider hop (hop 2) caps atpolicy_matchedorcryptographically_checked: several provider routes run GPU enclaves whose NVIDIA attestation chain is not available to verify, and chaining only the CPU quote would claim more than was checked. - They keep the TEE / E2EE distinction explicit. All content goes to the
confidential origin, where the relay runs in an attested TDX CVM and terminates
TLS in-enclave, so plaintext never reaches ordinary AnonRouter infrastructure.
What differs is the trust set: a TEE route has our attested relay handle
your plaintext inside the enclave, so you trust the reviewed build (and a
changed build fails your hop-1 check); an E2EE route encrypts to the
provider's key, so the relay holds ciphertext regardless of what it runs.
verifyRoute()reports which you got ascontentVisibleToAnonRouter. - They fail closed. Missing collateral, a debug-mode enclave, an unpinned measurement, a nonce mismatch, or a route that attested something other than what you asked for all produce a failing verdict, never a silent pass.
New to the confidential model?
Or hand the whole thing to your agent
One prompt carries the entire setup. Give it to your agent, review what it configures, and you are done.