Govern what you route through it.
One call, signed receipts on every one.

How it works · 4 steps · 5 minutes

From idle install to a verifiable audit trail in under five minutes.

1. 01

   Point your app at the gateway

   Set SYNOI_GATEWAY_URL and wrap any action with gate() from @synoi/sdk: an API call, a payment, a device, an integration, or an LLM call. Every one gets a policy decision and a signed receipt.

   export SYNOI_GATEWAY_URL=https://gateway.synoi.systems
   
   import { gate } from '@synoi/sdk'
   const result = await gate(
     { tool_name: 'payments.charge', tool_input: { amount: 4200 } },
     () => charge(),
   )

2. 02

   Already routing LLM traffic? Same idea, zero code

   For the specific case of existing LLM calls, just repoint your base URL, no SDK required. The protocol matches your existing provider (Anthropic-shaped or OpenAI-shaped) so no client changes are needed. Your upstream key flows through as X-Provider-Key: forwarded to the provider, never written to any SynOI database.

   # Anthropic-shaped clients (Claude Code, Cursor, OpenClaw, ...)
   export ANTHROPIC_BASE_URL=https://gateway.synoi.systems/anthropic
   
   # OpenAI-shaped clients
   export OPENAI_API_BASE=https://gateway.synoi.systems/v1
   
   # Your key in your tool's config, unchanged. Gateway forwards it, never stores it.
   ANTHROPIC_API_KEY=sk-ant-...
   # (or OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, ...)

3. 03

   Traffic flows · receipts mint · MCP tool calls signed too

   Every request is governed against your risk policy, optionally routed through HITL if the call crosses a configured blast-radius threshold, and signed with a hybrid (Ed25519 + ML-DSA-65) receipt. Every MCP tool-call decision (allow, deny, require-approval, HITL outcome) also produces a signed receipt. Compliance tags (NIST AI RMF, EU AI Act, ISO 42001, SOC 2) are mapped in the receipt schema; SynOI's own SOC 2 Type II attestation is planned, not yet started. Agents do not bypass the audit trail. P99 latency overhead under 2ms for cached paths (measured internally).

   # A single curl now produces a receipt:
   curl -i https://gateway.synoi.systems/anthropic/v1/messages \
     -H 'X-Provider-Key: $ANTHROPIC_API_KEY' \
     -H 'X-SynOI-Tenant: acme-prod' \
     -d '{ "model": "claude-opus-4-7", "messages": [...] }'
   
   # Response includes header:
   # X-SynOI-Receipt-Id: rcpt-1779234155-9q3kz1xv
   
   # Same for MCP tool calls:
   curl -i https://gateway.synoi.systems/mcp/proxy \
     -H 'X-MCP-Upstream: https://your-mcp-server/mcp' \
     -d '{ "jsonrpc":"2.0", "id":1, "method":"tools/call", ... }'
   # Every decision gets a receipt: deny / allow / HITL outcome.

4. 04

   Verify, offline, anywhere

   The receipt carries a canonical JSON body and hybrid (Ed25519 + ML-DSA-65) signatures. Auditors, customers, or your own CI can verify the classical signature offline with any standard Ed25519 library, against our published public key. No SynOI account required. A hosted receipt-lookup URL (oid.synoi.systems) is planned but not yet deployed.

   # Verify in code, offline, against the published public key:
   import { verify } from '@synoi/sdk/receipts'
   const ok = await verify(receiptBody, signature, publicKey)
   
   # Planned (not yet deployed): a hosted lookup URL, illustrative form:
   # -> https://oid.synoi.systems/r/rcpt_8b3c9f...