# ZeroLeaks Developer Platform

ZeroLeaks provides three developer products:

1. @zeroleaks/sdk: production-fidelity runtime scans for AI SDK, OpenAI, custom handlers, and deployed endpoints, plus prompt scans, skill scans, and reports.
2. @zeroleaks/shield: local runtime prompt hardening, injection detection, and output sanitization.
3. zeroleaks: open-source local scan engine and CLI using the developer's model-provider credentials.

## Primary Resources

- Documentation: https://zeroleaks.ai/docs
- SDK documentation: https://zeroleaks.ai/docs/sdk
- Shield documentation: https://zeroleaks.ai/docs/shield-sdk
- Local package documentation: https://zeroleaks.ai/docs/zeroleaks-package
- OpenAPI: https://zeroleaks.ai/openapi.json
- Full agent context: https://zeroleaks.ai/llms-full.txt

## Hosted SDK

Install @zeroleaks/sdk, set ZEROLEAKS_API_KEY to a zl_live_ API key, and initialize new ZeroLeaks(). The SDK is server-side only and uses the versioned /api/v1 API.

The primary namespace is runtimeScans. It relays hosted attacks through the real local application agent, preserves isolated sessions, loads complete tool definitions by default, and records actual tool calls and results. Provider adapters are available from @zeroleaks/sdk/ai-sdk and @zeroleaks/sdk/openai.

Other namespaces are scans, reports, endpointConfigs, endpointScans, skillScans, and health. agentConfigs and agentScans are compatibility aliases.

## Authentication

Send Authorization: Bearer zl_live_... to /api/v1 endpoints. Never expose an API key in browser code, mobile applications, logs, or source control.