Drop-in proxy for any AI tool.
One env var. Signed receipts on every call.

How it works · 4 steps · 5 minutes

From idle install to a verifiable audit trail in under five minutes.

1. 01

   Set the gateway URL

   Point your tool's API base URL at gateway.synoi.systems. The protocol matches your existing provider (Anthropic-shaped or OpenAI-shaped) so no client changes are needed.

   # Anthropic-shaped clients (Claude Code, Cursor, OpenClaw, ...)
   export ANTHROPIC_BASE_URL=https://gateway.synoi.systems/anthropic
   
   # OpenAI-shaped clients
   export OPENAI_API_BASE=https://gateway.synoi.systems/v1

2. 02

   Bring your provider key

   Your upstream key flows through as X-Provider-Key. It's forwarded to the provider and never written to any SynOI database. A CI test scans the DB after each release to assert this invariant.

   # Your key in your tool's config — unchanged.
   # Gateway forwards it. We never store it.
   ANTHROPIC_API_KEY=sk-ant-...
   # (or OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, ...)

3. 03

   Traffic flows · receipts mint · MCP tool calls signed too

   Every request is governed against your risk policy, optionally routed through HITL if the call crosses a configured blast-radius threshold, and signed with a hybrid (Ed25519 + ML-DSA-65) receipt. Every MCP tool-call decision (allow, deny, require-approval, HITL outcome) also produces a signed receipt. Compliance tags (NIST AI RMF, EU AI Act, ISO 42001, SOC 2) are mapped in the receipt schema; full compliance certification is pending SOC 2 audit completion. Agents do not bypass the audit trail. P99 latency overhead under 2ms for cached paths.

   # A single curl now produces a receipt:
   curl -i https://gateway.synoi.systems/anthropic/v1/messages \
     -H 'X-Provider-Key: $ANTHROPIC_API_KEY' \
     -H 'X-SynOI-Tenant: acme-prod' \
     -d '{ "model": "claude-opus-4-7", "messages": [...] }'
   
   # Response includes header:
   # X-SynOI-Receipt-Id: rcpt-1779234155-9q3kz1xv
   
   # Same for MCP tool calls:
   curl -i https://gateway.synoi.systems/mcp/proxy \
     -H 'X-MCP-Upstream: https://your-mcp-server/mcp' \
     -d '{ "jsonrpc":"2.0", "id":1, "method":"tools/call", ... }'
   # Every decision gets a receipt: deny / allow / HITL outcome.

4. 04

   Verify, offline, anywhere

   The receipt URL is public, unauthenticated, and renders the canonical JSON body and hybrid (Ed25519 + ML-DSA-65) signatures. Auditors, customers, or your own CI can verify the classical signature offline with any standard Ed25519 library. No SynOI account required.

   # Open in any browser:
   https://verify.synoi.systems/rcpt_8b3c9f...
   
   # Or verify in code, against the published public key:
   import { verify } from '@synoi/sdk/receipts'
   const ok = await verify(receiptBody, signature, publicKey)