Integrate an agent or tool

Add Sernixa immediately before the code that performs a meaningful action. The SDK requests a decision, waits safely when review is required, and calls your function only after an approved outcome.

Connect Codex, Claude, or Cursor

Install the CLI and use browser sign-in:

python3 -m pip install --upgrade sernixa-cli
sernixa auth login
sernixa protect

The current public CLI, Python SDK, TypeScript SDK, and bundled Codex/Claude plugin release is 0.6.4. These install commands intentionally select the latest release.

protect preserves unrelated host configuration and installs the supported Sernixa integration. Trust the Sernixa UserPromptSubmit and PreToolUse hooks when Codex or Claude asks, then start a new agent task. Verify the active protection path:

sernixa protect --status
sernixa doctor --strict

These commands report the integration as ready only after the required hooks are active.

Run sernixa to open the persistent console. Type @ for the selectable plan-aware palette; direct commands are also available and remain enforced by the backend.

Install and configure

The TypeScript SDK supports Node.js 18 or later.

npm install @sernixa/sdk@latest
export SERNIXA_BASE_URL=https://api.sernixa.com
export SERNIXA_API_KEY="<your-organization-api-key>"

Create the client from environment variables so credentials are not embedded in source code:

import { Client } from '@sernixa/sdk'

const client = new Client()

Interactive developer tools may use the SDK browser-device flow and construct a client with the returned accessToken. Deployed services should use a separate, least-privilege organization API key. Both credential types are checked against the same backend permissions and plan entitlements.

Before the first action, verify the credential and organization:

const identity = await client.whoami()
console.log(identity.organization_id, identity.permissions)

Gate a function

Wrap the smallest function that crosses a meaningful trust boundary. Use stable, policy-friendly context and keep unnecessary data out of metadata.

const governedRead = client.intercept(async (documentId: string) => documents.read(documentId), {
  intentId: 'customer-document-read',
  riskLevel: 'LOW',
  operationClass: 'read',
  dataSensitivity: 'confidential',
  systemsTouched: ['document-store'],
})

const document = await governedRead('doc_123')

The wrapped function remains yours. Validate its return value and handle its own business errors after Sernixa allows it to run.

For Codex and Claude, Sernixa uses the verified direct request as the scope. Exact work inside that scope does not need another Sernixa approval merely because it changes state. New or unclear scope can require review, and a hard organization policy still blocks the action.

Handle every outcome

Your integration should have an intentional path for:

Gate an MCP-style call

Ask Sernixa whether the proposed tool call may proceed, then let the MCP host dispatch an allowed call:

const decision = await client.mcpCallGate({
  mcpToolsetId: 'workspace-tools',
  toolName: 'read_file',
  intentId: 'read-workspace-report',
  arguments: { path: '/workspace/report.md' },
  riskLevel: 'LOW',
  operationClass: 'read',
  dataSensitivity: 'internal',
})

if (decision.status === 'accepted' || decision.status === 'auto_approved') {
  await mcpHost.callTool('read_file', { path: '/workspace/report.md' })
}

Sernixa governs the decision. The host owns the MCP connection, dispatch, timeout, response validation, and destination-system error handling.

Production checklist

• Use a separate, least-privilege key for each application and environment.
• Keep a stable agent identity, intent ID, and operation taxonomy.
• Leave argument capture off unless review genuinely requires values.
• Test approval, rejection, block, expiry, authentication failure, and network failure.
• Make retries idempotent for mutable actions.
• Verify a low-risk action in the Command Center before adding high-impact operations.
• Record the downstream result when end-to-end completion matters.

Next step

Secure the integration with Authentication and API keys, then configure Policies and controls.