Developer SDK and gateway. Open source, Apache 2.0.
See every model call your code makes.
Two lines of code, or none. The SDK and the gateway record which model was called, by which team, for what purpose and at what cost, and turn it into one register of the AI your organisation runs.
The SDK wraps OpenAI and Anthropic. The gateway speaks the OpenAI API to more than 70 providers.
You cannot govern what you have not counted.
Most organisations cannot say which business processes depend on which models, holding which data, owned by whom. Procurement misses the API key a team expensed last quarter. The CMDB misses the model call buried in a microservice.
Without a live inventory, EU AI Act classification, ISO 42001 scoping and third-party risk review are all done against a guess.
Two ways in
Python SDK
Swap the client and every call reports itself, with business context attached. Works with OpenAI and Anthropic, sync and async.
app.py
from prompt_shields import ShieldsOpenAI
client = ShieldsOpenAI(
api_key="sk-...",
ps_api_key="ps-...",
ps_collector_url="http://localhost:8000",
business_unit="HR",
use_case="interview-screening",
owner="jane.doe@acme.com",
data_classification="confidential",
)
client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": "..."}],
)AI gateway
Point your base URL at the proxy and change nothing else. The headers are optional and add ownership to each record.
no code change
export OPENAI_BASE_URL=http://localhost:8787/v1
# your code, unchanged
from openai import OpenAI
client = OpenAI()
client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": "..."}],
extra_headers={
"X-PS-Business-Unit": "HR",
"X-PS-Use-Case": "interview-screening",
"X-PS-Owner": "jane.doe@acme.com",
},
)Both are fail-open. If the collector is unreachable, the model call goes through anyway and the event waits in a local buffer.
What it records
Metadata about the call, not the call itself. Prompt text stays in your process unless you switch it on.
- Vendor, model, tokens, latency, cost
- Cost comes from a built-in pricing table for OpenAI, Anthropic and Google models.
- Ownership
- Business unit, use case, owner, environment and data classification, as you supply them.
- PII categories
- Email, phone, card number and five more. The category only, never the matched value.
- Tool and function calls
- OpenAI tool calls and Anthropic tool-use blocks.
- API key fingerprint
- A truncated SHA-256 hash. The raw key never leaves your process.
- Requested and served model
- So that savings from cost-aware routing can be shown, not assumed.
From a model call to a register
1
Collect
The SDK and the gateway each report a small structured event for every model call. Browser extensions and the macOS app report into the same place.
2
Deduplicate
The collector folds those events into AI assets: one vendor, one model, one business unit, one purpose. A thousand calls become one line an auditor can read.
3
Score
Each asset gets a confidence level from how many independent sources reported it. Two or more sources make it verified.
4
Export
Read the register over a REST API, or sync it to Ardoq, ServiceNow or your own tooling through the Partner API, with OAuth 2.0, delta sync and bulk export.
The register is what Atlas AI reads from, and what your governance tools can pull into their own model.
Clone it. Run it. Read every line.
The SDK, the collector, the registry and our gateway fork are in one public repository. It runs on your machine with Docker and Python 3.11. No account and no model API key needed to try it.
Full quickstart in the READMEterminal
# 1. Clone and start the registrygit clone https://github.com/Prompt-Shields/prompt-shields-sdk.git && cd prompt-shields-sdk docker compose up -d# 2. Install the SDK and collectorpip install -e "packages/sdk[all]" -e "packages/collector[dev]"# 3. Migrate and seed (exact commands in the README), then run the demopython3 demo/demo_sdk_flow.py
What it does not do
This is a discovery and inventory tool, not a control. If you have to sign off on what you deploy, these are the limits.
The full list, in the READMEIt does not block anything.
No prompt, response or tool call is filtered, redacted or refused. There is no prompt-injection or jailbreak defence in this code. It writes a record and gets out of the way.
PII detection is a hint, not a control.
It is pattern and keyword matching, and it is wrong in both directions. Use it to decide where to look, never as proof a payload was clean.
It only sees what you route through it.
A code path that uses neither the SDK nor the gateway is invisible, and the register cannot tell you it is missing.
The register is not an audit log.
Telemetry is fail-open and lossy by design. Each client buffers up to 1,000 events in memory and drops the oldest on overflow.
The self-hosted collector is not hardened for production.
Authentication, rate limiting and tenant isolation are development-grade. Closing those gaps is your job, or ours if we host it.