Free regulatory advisory in any MCP client, and five instrumentation paths from a one-line connection to full production capture. Every audit report states which path produced its evidence.
Regulatory guidance grounded in six frameworks, in Claude, ChatGPT, or any MCP-compatible client. Know what the law requires before you instrument.
MCP connector, Node SDK, Python SDK, HTTP API, or the n8n community node. Every path feeds the same tamper-evident AI agent audit trail.
Before you instrument anything, Truveil answers the question every agent builder has: what does the law actually require of my agent, and where is my design exposed? The Advisory tools are free, and they speak from the six frameworks Truveil is grounded in: the EU AI Act, NIST AI RMF, ISO/IEC 42001, India DPDP Rules 2025, DIFC Regulation 10, and Singapore's MGF-GenAI.
One of the six frameworks. Included in every tier.
Three tools, available the moment you connect:
Describe the agent you are building and get build-specific guidance: which obligations attach, which oversight pattern fits, what your audit trail needs to capture.
Ask about a specific provision and get the authoritative text with Truveil's plain-language reading alongside it.
A structured overview of AI governance for any jurisdiction Truveil covers, useful before you enter a new market.
Connect the Truveil MCP to Claude, ChatGPT, or any MCP-compatible client with your per-user API key sent as the x-client-secret header. Advisory works anywhere MCP reaches, including as an external tool inside an n8n agent node.
When you have Truveil's advisory MCP connected to your client, the LLM does not always know when to route to Truveil versus answer from its own training. The phrase "Use Truveil" is the explicit routing instruction.
You can also call Truveil's advisory in normal chat without the explicit phrase. The LLM will route to Truveil when the question is regulatory in nature, but the "Use Truveil" phrase explicitly triggers the routing. Worth using when you want primary-source citations rather than the LLM's training-data answer.
Example promptUse Truveil to advise on the following build: We're an insurance startup launching a claims-triage AI in 2027. The system reviews motor, home, and travel insurance claims with photos and prior claim history. Auto-settles approvals under £5,000. Expanding to EU and UAE within 18 months. What regulatory obligations apply, and which should we resolve first?
Advisory tells you what accountability requires. The five paths below are how your agent proves it.
Request accessConnect Truveil as an MCP tool to Claude, ChatGPT, or any MCP-compatible client. One connection, no code. Your conversational agent's decisions, disclosures, and human checkpoints are captured through natural tool use, and a full audit report is one request away.
Setup: add the Truveil MCP endpoint to your client and authenticate with your per-user API key as the x-client-secret header. The connector endpoint is issued with your account, so complete signup first.
MCP clients cache tool lists. After Truveil ships updates, refresh your connector to reload the current tools.
The audit MCP exposes seven instrumentation tools through the standard MCP protocol. Same Schema-v2 evidence model. Same regulatory grounding. Same audit reports.
Register your agent at session start. Same parameters as the SDK.
Log every state change. Same parameters as the SDK.
Log every reasoning step. Same parameters as the SDK.
Gate consequential decisions in the allowlist. Same parameters as the SDK.
Generic approval gate. Same parameters as the SDK.
Retrieve your agent's registration and recent run history. Use for self-awareness when adapting strategy based on prior audit results.
Retrieve recent log entries. Use to verify what has been recorded, debug missing events, or reconstruct prior runs.
A single dependency-free file you vendor into your codebase. No package manager, no supply chain, no transitive risk. Version 0.2.0 carries the full capture contract: one run handle, and every accountability signal reachable in one named line.
JavaScriptconst Truveil = require('./truveil');
const truveil = new Truveil(
'https://api.truveil.app',
'your-truveil-api-key',
'My Agent'
);
const run = truveil.run();
run.disclosure('This screening is AI-generated decision support.');
run.oversightMode('human_on_loop');
for (const item of pipeline) {
run.decision(item.id, {
factors: item.reasonsForAndAgainst,
outcome: item.verdict,
confidence: item.score / 100,
});
}
run.stage('screening').complete('42 of 60 advanced');
require('./truveil') resolves to it.
Fire-and-forget by design: a logging failure never blocks your agent. Per-subject decision records, stage completions that record what happened rather than what was about to happen, and named one-liners for every signal your agent genuinely has. The SDK never infers or manufactures evidence; it makes truthful capture effortless.
The identical 0.2.0 capture contract, ported method for method and enforced by the same contract test. If your agent is Python, nothing is lost in translation. The same vendored-file framing applies: one readable file, no package manager, no supply chain.
Pythonfrom truveil_sdk import TruveilSDK
sdk = TruveilSDK(
'https://api.truveil.app',
'your-truveil-api-key',
'My Agent',
)
run = sdk.run()
run.disclosure('This screening is AI-generated decision support.')
for item in pipeline:
run.decision(
item.id,
factors=item.reasons,
outcome=item.verdict,
confidence=item.score / 100,
)
run.stage('screening').complete('42 of 60 advanced')
from truveil_sdk import TruveilSDK resolves to it.
Everything the SDKs do is available directly over HTTPS. Authenticate every request with your per-user API key as the x-client-secret header, and log from any language or runtime.
Terminalcurl -X POST https://api.truveil.app/log \
-H "Content-Type: application/json" \
-H "x-client-secret: your-truveil-api-key" \
-d '{
"agent": "My Agent",
"run_id": "run_20260712_a1b2c3",
"action": "decision: applicant-1042",
"detail": "REJECT | income verification failed on two sources",
"confidence": 0.82
}'
The SDKs are thin, readable wrappers over this surface. If you want to see exactly what they send, read the file; it is one file.
n8n integrates through the dedicated community node, n8n-nodes-truveil, built in n8n's native node format. Install the node, create a Truveil API credential with your per-user API key (sent as x-client-secret), and add Truveil steps to any workflow. Registration, decision logging, approvals, and audit history are all available as node operations.
InstallIn n8n: Settings, Community Nodes, Install, then enter n8n-nodes-truveil.
This is a purpose-built node, not an MCP attachment. Your credential is stored in n8n's credential vault and sent as a header, never in a URL.
Truveil reports carry an instrumentation coverage line: which integration path produced the evidence, how many events were actually logged, and what that path structurally cannot observe. Steps reconstructed from sparse evidence are visibly marked as inferred, distinct from steps backed by logged events.
An MCP-instrumented report and an SDK-instrumented report are both honest about their coverage. That difference is printed on the page, not hidden in a methodology PDF. If you want a stronger evidence base, the report itself shows you exactly which integration upgrade earns it.
No accountability vendor discloses instrumentation provenance. We think an audit that will not tell you how it knows is not an audit.
Truveil's Custom GPT exposes the same advisory tools as the MCP via ChatGPT's OpenAPI Action surface. For ChatGPT users who prefer not to install MCP directly.
The Truveil Custom GPT is a pre-built GPT installed from the GPT Store. The advisory schema is already configured. Setup takes one click.
Building your own GPT action instead? The schema below matches the live Advisory API and authenticates with your API key as a Bearer token.
{
"openapi": "3.1.0",
"info": {
"title": "Truveil Advisory",
"version": "1.1.0"
},
"servers": [{ "url": "https://api.truveil.app" }],
"components": {
"securitySchemes": {
"BearerAuth": {
"type": "http",
"scheme": "bearer",
"description": "Your Truveil API key as a Bearer token"
}
}
},
"security": [{ "BearerAuth": [] }],
"paths": {
"/v1/advisory/start": { "post": { "operationId": "routeIntent" } },
"/v1/advisory/consult-regulation": { "post": { "operationId": "consultRegulation" } },
"/v1/advisory/consult-build": { "post": { "operationId": "consultBuild" } },
"/v1/advisory/jurisdiction-brief": { "post": { "operationId": "getJurisdictionBrief" } }
}
}
Coming to the public GPT Store soon. Until then, direct install link sent after Truveil signup.
Audit logs are hash-chained and tamper-evident. Verification replays the chain and halts at the first entry it cannot account for, naming that entry — a modification surfaces there or at the entry that follows it. Recorded erasures are bridged, so a lawful deletion reads as an erasure on record, not as tampering.
Native bias screening on logged decision sets for high-consequence categories. Today, the engine scores whether your own bias testing is logged; this brings the analysis in-house.
Scoring thresholds adapt to the agent's declared category, with the category source shown on every report for regulator defensibility.
Findings cite primary regulatory text with jurisdiction-aware, two-layer citations across all six frameworks, including ISO/IEC 42001 readiness mapping. Readiness mapping is preparation, not certification.
Advisory is free in any MCP client. When your agent needs to prove itself, five instrumentation paths run from a one-line connection to full production capture.