Point the official openai npm SDK at the gateway with a one-line baseURL change and every call gets local guardrails, gateway headers, and a hash-chained signed receipt. The script makes one clean call (and prints the risk header), then sends a prompt injection that the gateway blocks with a 403 before it reaches the provider.
npm install
# In another terminal, start the gateway (defaults to proxying OpenAI):
npx @axiorank/gatewayexport OPENAI_API_KEY=sk-...
node main.mjsYour key rides in the Authorization header on each request. The gateway forwards it upstream and never stores it.
$ node main.mjs
Because a gateway gives you one enforcement point where every model call is
inspected against policy and receipted before it reaches a provider.
x-axiorank-risk: 50
blocked 403 (axiorank_blocked): held for review by AxioRank gateway: Risk score 68 is in the review band (50 to 74). The hosted product turns holds into human approvals.
A clean model call sits at the neutral baseline risk of 50. Detector signals only push the score up, and a call is stopped when it crosses a threshold while carrying signals (hold at 50, deny at 75 by default). The injection scores 68 with an injection signal, landing in the review band; the OSS gateway has no approval queue, so a hold blocks with a 403.
The blocked call never leaves your machine: guardrails run locally and injection cannot be masked away, so the gateway answers the 403 itself. The error is a normal OpenAI.APIError (status 403, type "axiorank_blocked"), so your existing SDK error handling just works.
Every response, including the block, also appends a signed receipt to ~/.axiorank/gateway/receipts.jsonl. Verify the chain offline:
npx @axiorank/gateway verify ~/.axiorank/gateway/receipts.jsonl
# receipt chain valid (2 receipts, key 4b9d21ac)No OpenAI key handy? Run npx @axiorank/gateway demo for a fully offline tour of the same guardrails.