TREZA SDK

TypeScript SDK for interacting with TREZA's privacy-preserving KYC system and secure enclave management platform.

Table of Contents

• Features
• AI Agent Integration
• x402 Payment Integration
• Quick Start
• Core Features
  • KYC Features
  • Enclave Platform
• Architecture
• API Reference
• Examples
• Documentation
• Development
• Support
• License

Features

Enclave Platform Features

• Secure Enclave Deployment - Deploy and manage AWS Nitro Enclaves with cryptographic attestation
• Lifecycle Management - Full control over enclave state (deploy, pause, resume, terminate)
• Attestation & Verification - Hardware-backed cryptographic proof of enclave integrity
• Comprehensive Logging - Access logs from ECS, Step Functions, Lambda, and applications
• Provider Management - Support for multiple cloud providers and regions
• Task Scheduling - Schedule and manage automated tasks within enclaves
• GitHub Integration - Connect enclaves directly to GitHub repositories
• Docker Support - Search and deploy Docker Hub images
• API Key Management - Fine-grained access control with permissions

Secure Key Management

• Enclave Signing - Transaction signing inside hardware-isolated Nitro Enclaves (recommended)
• Pluggable Signers - Swap between enclave, local, or browser wallet signing with one line
• No Key Exposure - Private keys never leave the TEE in production
• Attestation Verification - Cryptographic proof of enclave integrity before signing

x402 Payments

• Enclave as Payment Wallet - Use TEE-held keys to sign x402 payment headers
• Automatic Payments - Wrap fetch or axios to handle 402 responses transparently
• Bazaar Discovery - Find x402-payable services programmatically
• AI Agent Commerce - Agents can autonomously pay for APIs using enclave-managed funds

KYC Features

• Zero-Knowledge KYC - Verify identity without exposing personal data
• Blockchain Integration - Direct integration with KYCVerifier smart contracts
• Convenience Methods - Simple APIs for common KYC checks (age, country, document validity)
• Dual Verification - API-based (fast) OR blockchain-based (trustless)
• Multi-Chain Support - Ethereum, Sepolia, and compatible networks

PII Redaction

• Direct Redaction - Strip PII from any text with one call (redactText)
• OpenAI-Compatible Proxy - Redact chat messages before they reach your LLM (redactChatCompletions)
• API-Key Auth - Programmatic access as an alternative to the hosted redaction proxy
• Audit & Attestation - Entity-count audit log and TEE attestation summaries

AI Agent Support

• MCP Server - @treza/mcp for Claude, Cursor, and any MCP-compatible agent
• OpenAPI 3.1 Spec - Machine-readable API schema for agent frameworks (LangChain, CrewAI, etc.)
• Agent Manifest - Auto-discoverable capabilities at /.well-known/ai-plugin.json

Developer Experience

• TypeScript Support - Full type safety and IntelliSense
• Easy Integration - Works with any TypeScript/JavaScript project
• Code Generation - Auto-generate integration snippets in multiple languages
• No Authentication Required - Open API protected by rate limiting (KYC endpoints)
• Secure by Design - No personal data storage, cryptographic proofs only

AI Agent Integration

Treza enclaves are designed to work with AI agents out of the box. Three integration paths are available:

MCP Server (Recommended for AI Agents)

The @treza/mcp package exposes all Treza operations as MCP tools. Add it to any MCP-compatible client:

{
  "mcpServers": {
    "treza": {
      "command": "npx",
      "args": ["@treza/mcp"],
      "env": {
        "TREZA_BASE_URL": "https://app.trezalabs.com"
      }
    }
  }
}

This gives agents access to 16 tools (enclave management, attestation verification, task scheduling, API key management) and 4 browsable resources.

OpenAPI Spec (For Agent Frameworks)

The full API is documented as an OpenAPI 3.1 spec, compatible with any agent framework that can ingest tool schemas:

https://app.trezalabs.com/.well-known/openapi.json

Agent Manifest (For Discovery)

A machine-readable manifest describing Treza's capabilities:

https://app.trezalabs.com/.well-known/ai-plugin.json

x402 Payment Integration

Use a Treza Enclave as an x402 payment wallet. Private keys sign payment headers inside the TEE — they never leave the hardware boundary. This enables AI agents and programmatic clients to automatically pay for x402-gated APIs using enclave-managed funds.

Install Dependencies

npm install @treza/sdk ethers @x402/fetch @x402/core @x402/evm

Automatic Payments with Fetch

import { TrezaClient, createEnclaveFetch } from '@treza/sdk';

const client = new TrezaClient({
  baseUrl: 'https://app.trezalabs.com',
});

// Wrap fetch — 402 responses are paid automatically
const paidFetch = await createEnclaveFetch(client, {
  enclaveId: 'enc_abc123',
  verifyAttestation: true, // verify enclave integrity before each payment
});

const response = await paidFetch('https://api.example.com/paid-endpoint');
const data = await response.json();

Using the x402 Client Directly

import { TrezaClient, createEnclaveX402Client } from '@treza/sdk';
import { wrapFetchWithPayment } from '@x402/fetch';

const client = new TrezaClient({ baseUrl: 'https://app.trezalabs.com' });
const { x402, account } = await createEnclaveX402Client(client, {
  enclaveId: 'enc_abc123',
});

console.log('Payment wallet:', account.address);

// Use x402 client with any wrapper
const paidFetch = wrapFetchWithPayment(fetch, x402);

Custom viem Account

For advanced use cases, create a viem-compatible account directly:

import { TrezaClient, createEnclaveAccount } from '@treza/sdk';
import { x402Client } from '@x402/core/client';
import { registerExactEvmScheme } from '@x402/evm/exact/client';

const client = new TrezaClient({ baseUrl: 'https://app.trezalabs.com' });
const account = await createEnclaveAccount(client, { enclaveId: 'enc_abc123' });

// Register with x402 manually
const x402 = new x402Client();
registerExactEvmScheme(x402, { signer: account });

Discover Payable Services

import { discoverPayableServices } from '@treza/sdk';

const services = await discoverPayableServices({
  maxPrice: '0.01',
  network: 'eip155:8453', // Base mainnet
});

console.log('Available services:', services.length);

Quick Start

Installation

npm install @treza/sdk ethers

Environment Setup

Create a .env file:

# API Configuration
TREZA_API_URL=https://api.trezalabs.com/api
# For local development: http://localhost:3000/api

# Enclave Platform
TREZA_PLATFORM_URL=https://app.trezalabs.com
WALLET_ADDRESS=0x...your-wallet-address

# Blockchain Configuration (for KYC)
SEPOLIA_RPC_URL=https://rpc.sepolia.org
SEPOLIA_KYC_VERIFIER_ADDRESS=0xB1D98F688Fac29471D91234d9f8EbB37238Df6FA

# Enclave ID for signing (production)
TREZA_ENCLAVE_ID=enc_...your-enclave-id

See .env.example for all available configuration options.

Basic Usage - KYC with Enclave Signing (Recommended)

In production, private keys are managed inside Treza Nitro Enclaves and never leave the hardware-isolated TEE. The SDK provides pluggable signers so you can swap between enclave signing, local keys, or browser wallets with one line of code.

import { TrezaClient, TrezaKYCClient, EnclaveSigner } from '@treza/sdk';

// 1. Connect to the Treza platform
const platform = new TrezaClient({
  baseUrl: process.env.TREZA_PLATFORM_URL,
});

// 2. Create an EnclaveSigner (keys never leave the TEE)
const signer = new EnclaveSigner(platform, {
  enclaveId: process.env.TREZA_ENCLAVE_ID!,
  verifyAttestation: true, // verify enclave integrity before signing
});

// 3. Initialize the KYC client with secure signing
const client = new TrezaKYCClient({
  apiUrl: process.env.TREZA_API_URL!,
  blockchain: {
    rpcUrl: process.env.SEPOLIA_RPC_URL!,
    contractAddress: process.env.SEPOLIA_KYC_VERIFIER_ADDRESS!,
    signerProvider: signer,
  },
});

// Submit proof on-chain (signed inside the enclave)
const txHash = await client.submitProofOnChain({
  commitment: proof.commitment,
  proof: proof.proof,
  publicInputs: proof.publicInputs,
});

Local Development (Demo Only)

For local development and testing, you can use LocalSigner with a raw private key. Do not use this in production.

import { TrezaKYCClient, LocalSigner } from '@treza/sdk';

const client = new TrezaKYCClient({
  apiUrl: 'http://localhost:3000/api',
  blockchain: {
    rpcUrl: 'http://localhost:8545',
    contractAddress: '0x...',
    signerProvider: new LocalSigner(process.env.PRIVATE_KEY!),
  },
});

Read-Only Usage (No Signing)

Many KYC operations don't require signing at all:

import { TrezaKYCClient } from '@treza/sdk';

const client = new TrezaKYCClient({
  apiUrl: process.env.TREZA_API_URL!,
  blockchain: {
    rpcUrl: process.env.SEPOLIA_RPC_URL!,
    contractAddress: process.env.SEPOLIA_KYC_VERIFIER_ADDRESS!,
  },
});