
Security News
When Autonomous Agents Escape: Why Socket Signed the Cyber Defense Open Letter
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.
@postcept/sdk
Advanced tools
TypeScript client for the Postcept API, Proof-of-Completion for AI agents. Verify high-risk agent actions against the system of record and get a signed completion receipt.
Typed TypeScript client for the Postcept API.
Postcept is Proof-of-Completion for AI agents. After an agent takes a high-risk
action (a refund, a cancellation, a ticket resolution), you verify the action
actually happened in the system of record and get back a signed completion
receipt. "done" becomes proof, not a claim.
The package ships typed bindings generated from the API's OpenAPI contract, plus a
small PostceptAgent wrapper for the common flow. It runs in Node and any runtime
with fetch.
npm i @postcept/sdk
Create an organization API key in the dashboard, then verify a refund:
import { PostceptAgent } from "@postcept/sdk";
const postcept = new PostceptAgent({ apiKey: process.env.POSTCEPT_API_KEY! });
const result = await postcept.verifyRefund({
operationId: "refund_8F31", // stable across retries and handoffs
agentId: "SupportAgent-04",
refundId: "re_4md82k",
amountCents: 12000,
currency: "usd",
customer: "mara.ellis@example.com",
idempotencyKey: "refund_8F31",
});
result.result; // "verified" | "incomplete" | "duplicated" | "mismatched" | "policy_failed"
result.receipt; // signed completion receipt
If the result is anything other than verified, the work is not done. Surface the
gap and recover.
PostceptAgent also exposes verifyCancellation, verifyTicket,
getVerification, and verifiedCompletionRate. Pass test: true on any verify
call to run against the sandbox connector, which is excluded from your Verified
Completion Rate.
Every operation is also a typed function, for full control over the request:
import { createClient, createConfig, verifiedCompletionRate } from "@postcept/sdk";
const client = createClient(createConfig({ baseUrl: "https://api.postcept.com" }));
const { data } = await verifiedCompletionRate({
client,
headers: { Authorization: `Bearer ${process.env.POSTCEPT_API_KEY}` },
});
Receipts are Ed25519-signed and verifiable on their own with the open
@postcept/receipt package. You
do not need to trust the API to trust a result.
MIT
FAQs
TypeScript client for the Postcept API. Outcome verification for AI agents: check high-risk agent actions against the system of record and get a signed completion receipt.
The npm package @postcept/sdk receives a total of 4 weekly downloads. As such, @postcept/sdk popularity was classified as not popular.
We found that @postcept/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.

Research
/Security News
Socket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious payloads.