WARRANTthree packages.
one public repository.
the client libraries are published as source, under Apache-2.0, in a repository anyone can read without an account. this page is the distribution record: what each package is called, what it needs, what licence it carries, and the install line that resolves today.
it documents no endpoint, no request shape and no key exchange. that is a separate door and it is shut. what is behind it is a normal product conversation — [email protected].
what each one is called.
distribution names, not import names. every test count on the right is that package's own suite, executed on 2026-08-10 rather than quoted from a badge.
Disambiguation · read this before you type a package name
A distribution called warrant-sdk exists on PyPI and is not Warrant's. As of 2026-08-10 it is version 0.1.2, described as bonded execution for onchain agents, and it points at a repository under a different account. Warrant has published nothing to PyPI. warrant-sdk is correct as the name of the repository above and wrong as the name of a package.
from the repository. not from a registry.
there is no pip install line and no npm install line on this page, because neither would resolve. that is a statement about today, dated, and it changes the day a first version is published.
# Python. pip resolves a git URL and a subdirectory pointer.
pip install "git+https://github.com/warrantlabs/warrant-sdk.git#subdirectory=python"
# or, from a local checkout:
pip install -e path/to/warrant-sdk/python
# Node. npm has no subdirectory syntax for a git URL and that repository
# has no root package.json, so a bare git-URL install cannot resolve.
# Clone first, then install the path.
git clone https://github.com/warrantlabs/warrant-sdk.git
npm install ./warrant-sdk/node
# or declare it in package.json:
{ "dependencies": { "warrant-labs": "file:../warrant-sdk/node" } }
Why no registry line
Probed 2026-08-10, with controls that discriminate on the same host in the same run. On PyPI, warrant-labs returned 404 while httpx returned 200 and a nonsense name returned 404. On npm, warrant-labs and warrant-labs-agent-sdk-hooks both returned 404 while express returned 200 and the same nonsense name returned 404.
So the names are unregistered, not reserved, and a printed command that 404s is worse than an omitted one. The install above is what was executed; nothing here is a plan described in the present tense.
Whether a version reaches PyPI or npm is the founder's decision and it has not been taken. When it is, this page changes on the same day and carries the date.
Apache-2.0, including the schemas.
one licence across all three packages and the published evidence schemas beside them. checked against the three manifests and the LICENSE file in each package directory.
not by this code.
the short version, because this page is about distribution and the long version has its own surface.
Nothing in these packages signs or checks anything. An evidence package is signed Ed25519 on Warrant's side, and its digest is anchored through OpenTimestamps into the Bitcoin chain, which fixes when the package existed against a public record Warrant does not control. The check itself runs in a reader's own browser at /verify — no account, no key, and no requirement to trust the client you installed, which is the entire point of publishing the schemas under a permissive licence. Confirm a real one at /verify?id=7de85ceaeac42a47.
listed. not recommended.
warrant-labs-agent-sdk-hooks is in the repository, carries the same licence, and its 38 tests pass. it is still not the path to start on, and the reasons are these.
- One package is going to a registry, not two. The core client is the supported route, and it is the one that will carry a version number a reviewer can pin. Starting on the adapter means starting on the surface with the shorter support horizon.
- Its own README prints no registry install line. It installs from a clone or a local path, which is a fine way to run something and a poor way to depend on it inside a regulated codebase where every dependency has to be named in a review.
- It is a courier. It holds no key material and makes no judgement about what an agent did. It returns no receipt either — resolving a submitted run to a package identifier is the core client's job, so a working setup ends up carrying both packages anyway.
- Records live in process memory until a turn completes. A crash before that loses the window and there is no recovery path. That is deliberate, because the alternative is a courier that can block the thing it is meant to observe, but it is a property you should choose knowingly rather than inherit.
None of that is a defect claim. A previous internal note said this package posted to a route that does not exist; that was false, it was withdrawn on 2026-08-10, and it should not be repeated. Use the adapter if you want Claude Agent SDK recording done for you, and read its README first.
stated plainly.
the gap between a product and its client library is where integrators lose time, so it is written down rather than discovered.
- They do not sign. No private key is held, loaded or used by any code in that repository. Signing happens on the service side.
- They do not check anything. Checking happens at the public permalink, or against the published schemas using an implementation of your own. A client asserting that its own server's output is valid would prove nothing, which is why the schemas are published.
- They do not decide whether an agent complied. That judgement is the pipeline's, and its output is the evidence package. The client carries it; it does not form it.
- Refused is not failed. A run reaches one of three terminal states. Refused means the pipeline read the trace and declined to sign it — a finding, not an outage, and the same trace refuses the same way every time. Page on failed; count refused.
- They are not a compliance product on their own, and nothing in them or on this page is legal advice.
the install needs no key.
a first run does. there is no self-serve signup; keys are issued per organisation, and if you do not have one, that is a conversation rather than a form.