Quick Start

The universal runtime target can wrap any agent framework.

import { ZeroLeaks, createRuntimeTarget } from "@zeroleaks/sdk";
import { productionAgent } from "./agent";

const zeroleaks = new ZeroLeaks();

const target = createRuntimeTarget({
  definition: {
    name: "Support agent",
    provider: "custom",
    model: "production-model",
    instructions: SUPPORT_INSTRUCTIONS,
    tools: productionTools.map((tool) => ({
      name: tool.name,
      description: tool.description,
      inputSchema: tool.inputSchema,
      outputSchema: tool.outputSchema,
    })),
  },
  invoke: async ({ messages, sessionId, signal }) => {
    const result = await productionAgent({ messages, sessionId, signal });
    return {
      text: result.text,
      messages: result.messages,
      toolCalls: result.toolCalls,
      usage: result.usage,
    };
  },
  reset: async (sessionId) => {
    await productionAgent.reset(sessionId);
  },
});

const { scan, report } = await zeroleaks.runtimeScans.run(target, {
  eventConcurrency: 8,
  workerStallTimeoutMs: 6 * 60_000,
  scan: { scanMode: "full" },
  onPoll: (current) => console.log(current.currentPhase),
});

console.log(scan.status, report.overallScore);

What happensCopy Anchor Link

1. The SDK sends the serializable target and tool definitions to ZeroLeaks.
2. The hosted engine asks your agent three reconnaissance questions and profiles its role, tools, and data.
3. The engine runs secrets-in-context, injection, and agent-specific probes (tool use, indirect content, multi-turn campaigns, and the production catalog) in parallel.
4. Your process claims independent probes concurrently and invokes the same production agent function used by your application. The SDK keeps each session ordered, maintains isolated conversation histories, and forwards tool-call traces.
5. ZeroLeaks judges the responses and returns one consolidated report.

Your model provider key, executable tool functions, retrieved documents, and local application state remain in your environment. Your tools run in your process, so point them at scan-safe dependencies. See tools and side effects.

scanMode: "full" is the default. It covers every attack surface and includes the complete production probe catalog, so it ignores attackSurfaces. Use scanMode: "quick" for a smaller development smoke test; quick mode honors attackSurfaces, knowledgeProfile, and maxAdaptiveCandidates.