Docs · Developer guide

Install Optics, then Phantom Engine.

This page is the install path. Optics records connection and process metadata from supported wrapped agent paths. Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state.

GitHub · open core Optics product page

terminal · vantio run node agent.jsIdle

$ vantio run node agent.js

[ ∅ VANTIO ] run · idle · waiting on company-suite telemetry

[ ∅ VANTIO ] Outbound LLM call intercepted
  host:  awaiting LLM egress
  → OBSERVED · metadata only

[ ∅ VANTIO ] Run Summary
  LLM calls: 0
  action:    OBSERVED

Optics quickstart

You do not need an account and we never keep your conversations. We just report the hard OBSERVED facts about your connections.

Install the CLI

Run one global install and you are ready to go on macOS, Linux, or Windows WSL.

npm i -g @vantio/cli

Wrap the agent process

Just add our prefix to your normal Node command. Optics watches the network layer to track data leaving the host without ever reading the actual conversations. It catches fetch, undici, http/https, websockets, and even spawned curl commands to major LLM providers. Browser traffic naturally stays out of this wrap.

# agent.js must call an LLM API via fetch (e.g. api.openai.com)
vantio run --summary node agent.js

Optional: Optics MCP

Optional read-only inspect helper for Optics runs. You can list runs, export proofs, and discover new hosts from a local MCP client. It does not block, redact, or enforce policy — Optics MCP is observe-only.

npx -y @vantio/optics-mcp

Cursor · mcp.json

{
  "mcpServers": {
    "vantio-optics": {
      "command": "npx",
      "args": ["-y", "@vantio/optics-mcp"]
    }
  }
}

Export a proof & inspect

You can export a proof, search through a captured run, or compare two runs without ever creating an account. The vantio prove command always grabs the newest log from your ~/.vantio/runs/ folder. If your agent never actually called an LLM, the wrap will not write a new log. If you are ever unsure, just run vantio prove --list to see exactly which run you are looking at.

vantio prove --list
vantio prove
vantio search openai
vantio tail
vantio diff <run-a> <run-b>
vantio discover --local

Python agents

Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state. Browser traffic stays outside this wrap.

On Ubuntu/Debian, use a virtualenv or pipx install vantio-agent-sdk — modern distros block global pip installs by default (PEP 668).

pip install vantio-agent-sdk
vantio run python agent.py

If something is not working

Here is how to fix common issues with Optics and Phantom Engine. None of these are remote operations that change things on your machine. If you try the fix below and are still stuck, shoot us an email at hello@vantio.ai or open a ticket in your customer portal.

The wrap ran but it recorded nothing: Your agent has to actually call a supported LLM host while running under vantio run or shield(). If the agent finishes without making an LLM call, we never write a new run log. You can check exactly which run you are looking at with vantio prove --list.
Prove is showing me an older run: The vantio prove command always pulls the most recent log. If your latest run did not intercept an LLM call, it does not write a new file. That means prove will show the last successful run instead. Use vantio prove --list to make sure the top row is the run you want.
Browser or Chat UI traffic is missing: Optics does not intercept traffic from your browser or a chat window. Phantom Engine secures the host machine itself, so it is not built to act like a browser plugin.
macOS or Windows WSL is not Phantom Engine Control: You can install Optics on macOS, Linux, and Windows with WSL. But that does not give you Phantom Engine Control. Phantom Engine only runs on Linux you enroll — a Helm DaemonSet on Kubernetes you operate, or a Linux daemon on standalone hosts.
Enforce did not block my request: Phantom Engine can only block what it sees through a supported application path or on an enrolled Linux host. If your traffic goes through a raw path, a skipped SDK, or a browser, application-path enforcement will not see it. Host-level authority requires Phantom Engine on enrolled Linux hosts.
Node versus Python commands: If you use Node, install with npm i -g @vantio/cli and then run vantio run --summary node agent.js. If you use Python, Python support requires vantio-agent-sdk. Follow the current Python SDK example and verify that a supported outbound event appears before relying on the coverage state.
Vulnerability or suspected compromise: Please do not debug a vulnerability or a live compromise in the public help assistant. Reach out directly to security@vantio.ai. You can also find our secure form at /contact?intent=security.

After Optics

Phantom Engine applies destination, sensitive-data, and spending policies on supported application paths and maintains host-level authority on enrolled Linux infrastructure when application controls are bypassed. Enterprise adds organizational governance and evidence.