
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@looptail/sdk
Advanced tools
Record every AI decision as a signed, append-only trail. Every loop leaves a tail.
Record every AI decision as a signed, append-only trail. Every loop leaves a tail.
npm install @looptail/sdk
import { Looptail } from '@looptail/sdk';
const lt = new Looptail({ app: 'support-agent' });
export const handleTicket = lt.trail(async (ticket) => {
// ...
});
// report an outcome signal when you learn how it went
lt.outcome(lt.lastEventId!, { csat: 5 });
Every call becomes a hash-chained, Ed25519-signed loop event appended to
.looptail/support-agent.jsonl. Nothing is edited in place; any modification,
deletion, or reorder of past records is detectable:
npx @looptail/cli verify --app support-agent
✔ 2 loop events
✔ chain intact · signatures valid
Or in code: lt.verify().
import { Looptail, instrumentAnthropic, loadRubric, judgeFromSpec, run, cluster } from '@looptail/sdk';
import Anthropic from '@anthropic-ai/sdk';
const lt = new Looptail({ app: 'support-agent' });
// Observe — every provider call becomes a signed observe event
const anthropic = instrumentAnthropic(new Anthropic(), lt);
// Understand — score recorded events against your rubric, cluster failures
const judge = await judgeFromSpec('anthropic:claude-opus-4-8'); // or openai:<model>
await run(loadRubric('rubrics/refund-policy.json'), lt, judge);
cluster(lt);
The whole loop — Observe, Understand, and Improve (propose / replay /
canary / approve) — is at full parity with the Python SDK: same rubric
prompt, judge schema, and event shapes, so a JS verdict, a Python verdict, and
a hosted verdict all agree. The provider SDKs (@anthropic-ai/sdk, openai)
are optional peer deps, only needed when you build a judge or proposer. From
the terminal: npx @looptail/cli evals run / issues cluster / improve.
~/.looptail/signing-key
(override with LOOPTAIL_SIGNING_KEY, hex seed).apiKey option or
LOOPTAIL_API_KEY), events also sync to the hosted Tail (private beta);
sync is best-effort and never blocks or crashes your app.Read the trust model in the spec before relying on local trails as evidence: self-signed trails are tamper-evident; hosted anchoring (v0.2) makes them stronger.
Docs: looptail.ai/docs · License: Apache-2.0
FAQs
Record every AI decision as a signed, append-only trail. Every loop leaves a tail.
We found that @looptail/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.