Docs · Developer guide

Install Optics. Add Gate or Phantom Engine when you need them.

This page is the install path. Optics records connection and process metadata from supported wrapped agent paths. Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state.

GitHub · open coreOptics product page
terminal · vantio run node agent.jsSnapshot
$ vantio run node agent.js

[ ∅ VANTIO ] run · Daily snapshot · company suite

[ ∅ VANTIO ] Outbound LLM call intercepted
  host:  vantio.ai
  time:  09:55:01
  → OBSERVED · 0 B

[ ∅ VANTIO ] Outbound LLM call intercepted
  host:  vantio.ai
  time:  09:50:02
  → OBSERVED · 0 B

[ ∅ VANTIO ] Outbound LLM call intercepted
  host:  vantio.ai
  time:  09:45:02
  → OBSERVED · 0 B

[ ∅ VANTIO ] Outbound LLM call intercepted
  host:  vantio.ai
  time:  09:40:01
  → OBSERVED · 0 B

[ ∅ VANTIO ] Run Summary
  LLM calls: 21,233
  action:    OBSERVED

Optics quickstart

You do not need an account and we never keep your conversations. We just report the hard OBSERVED facts about your connections.

  1. 01

    Install the CLI

    Run one global install and you are ready to go on macOS, Linux, or Windows WSL.

    npm i -g @vantio/cli

  2. 02

    Wrap the agent process

    Just add our prefix to your normal Node command. Optics watches the network layer to track data leaving the host without ever reading the actual conversations. It catches fetch, undici, http/https, websockets, and even spawned curl commands to major LLM providers. Browser traffic naturally stays out of this wrap.

    # agent.js must call an LLM API via fetch (e.g. api.openai.com)
vantio run --summary node agent.js

  3. 03

    Optional: Optics MCP

    Optional read-only inspect helper for Optics runs. You can list runs, export proofs, and discover new hosts from a local MCP client. It does not block, redact, or enforce policy — Optics MCP is observe-only.

    npx -y @vantio/optics-mcp

    Cursor · mcp.json

    {
  "mcpServers": {
    "vantio-optics": {
      "command": "npx",
      "args": ["-y", "@vantio/optics-mcp"]
    }
  }
}

  4. 04

    Export a proof & inspect

    You can export a proof, search through a captured run, or compare two runs without ever creating an account. The vantio prove command always grabs the newest log from your ~/.vantio/runs/ folder. If your agent never actually called an LLM, the wrap will not write a new log. If you are ever unsure, just run vantio prove --list to see exactly which run you are looking at.

    vantio prove --list
vantio prove
vantio search openai
vantio tail
vantio diff <run-a> <run-b>
vantio discover --local

Python agents

Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state. Browser traffic stays outside this wrap.

pip install vantio-agent-sdk
vantio run python agent.py

If something is not working

Here is how to fix common issues with Optics, Gate, and Phantom Engine. None of these are remote operations that change things on your machine. If you try the fix below and are still stuck, shoot us an email at hello@vantio.ai or open a ticket in your customer portal.

The wrap ran but it recorded nothing
Your agent has to actually call a supported LLM host while running under vantio run or shield(). If the agent finishes without making an LLM call, we never write a new run log. You can check exactly which run you are looking at with vantio prove --list.
Prove is showing me an older run
The vantio prove command always pulls the most recent log. If your latest run did not intercept an LLM call, it does not write a new file. That means prove will show the last successful run instead. Use vantio prove --list to make sure the top row is the run you want.
Browser or Chat UI traffic is missing
Optics and Gate do not intercept traffic from your browser or a chat window. Phantom Engine secures the host machine itself, so it is not built to act like a browser plugin.
macOS or Windows WSL is not Phantom Engine Control
You can install Optics and Gate on macOS, Linux, and Windows with WSL. But that does not give you Phantom Engine Control. Phantom Engine only runs on Linux you enroll — a Helm DaemonSet on Kubernetes you operate, or a Linux daemon on standalone hosts.
Gate did not block my request
Gate can only block what it sees through the wrap. If your traffic goes through a raw path, a skipped SDK, or a browser, Gate will not see it. If you need to stop processes that bypass the wrap completely, you need Phantom Engine running on enrolled Linux hosts.
Node versus Python commands
If you use Node, install with npm i -g @vantio/cli and then run vantio run --summary node agent.js. If you use Python, Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state.
Vulnerability or suspected compromise
Please do not debug a vulnerability or a live compromise in the public help assistant. Reach out directly to security@vantio.ai. You can also find our secure form at /contact?intent=security.

After Optics

Gate enforces destination, redaction, and spend rules on the same wrap. Application-layer controls remain useful, but they do not independently provide a host boundary when an autonomous workload can execute directly on infrastructure. Gate applies configured spend limits on supported agent traffic. Phantom Engine protects enrolled Linux hosts when a process bypasses the application path. Enterprise adds evidence and process.

Product pages

Head over to our product pages to learn exactly how each layer works. If you have questions that are not just install steps, our Support page has you covered.

Govern

Enterprise

Governance for autonomous systems on your infrastructure.

Enterprise →

See how the pieces fit together on our Architecture page and the install manual. Check our framework readiness under Compliance, or head to Support if you need anything else.