Skip to content

Reference

Install

The canonical install command for every supported language. This is the only page that lists install commands — every other doc, blog, and README links here.

Do not install bare evalguard

There are two unrelated third-party packages named evalguard on npm and PyPI. They are not affiliated with EvalGuard.

  • npm install evalguard resolves to an unrelated third-party package. Not us.
  • pip install evalguard resolves to an unrelated third-party package. Not us.

Always use the canonical names below — @evalguard/sdk on npm, evalguardai on PyPI, @evalguard/cli for the CLI. These are the only packages published by EvalGuard. Until registry naming is fully resolved, this banner stays.

Other registries (NuGet, crates.io, RubyGems, Packagist): we do not yet publish SDKs there. If you find a package using the EvalGuard name on any of those registries, it is not from us — please report it to security@evalguard.ai.

Canonical install commands

One canonical package per language. Each ships with the same authoritative EvalGuard client — pick the row that matches your stack.

TypeScript / JavaScript

@evalguard/sdk

Registry page
terminal
npm install @evalguard/sdk

Import

typescript
import { EvalGuard } from "@evalguard/sdk";

Python

evalguardai

Registry page
terminal
pip install evalguardai

Import

python
from evalguard import EvalGuardClient

CLI (Node.js)

@evalguard/cli

Registry page
terminal
npm install -g @evalguard/cli

Import

terminal
evalguard --version

Go

github.com/EvalGuardAi/evalguard-go

Registry page
terminal
go get github.com/EvalGuardAi/evalguard-go@latest

Import

go
import evalguard "github.com/EvalGuardAi/evalguard-go"

Verify cryptographic provenance

Every @evalguard/* npm release carries the registry signature npm applies to all published packages, so a tampered tarball fails npm audit signatures. We do notyet publish Sigstore provenance attestations, so that command cannot tell our package apart from an impersonator's — an unrelated package is signed by the registry too. Until provenance ships, the control that distinguishes ours is the exact coordinate: the canonical names in the table above, and nothing else.

terminal
npm install @evalguard/sdk
npm audit signatures
# Reports the whole dependency tree, not one package — e.g.
#   46 packages have verified registry signatures
#   6 packages have verified attestations
# The attested ones are third-party dependencies. No @evalguard/*
# package is attested today; verify the name, not the badge.

Deprecated aliases

These names point at deprecation-shim packages we publish to keep old install commands working — they re-export the canonical and emit a deprecation warning. Migrate to the canonical name on the right; the shim slot may be sunsetted in a future release.

Deprecated nameRegistry→ Canonical
evalguardai-sdknpm@evalguard/sdk
evalguard-sdknpm (unscoped)@evalguard/sdk
@evalguardai/sdknpm@evalguard/sdk
@evalguardai/clinpm@evalguard/cli
evalguard-sdkPyPIevalguardai
evalguard-pythonPyPIevalguardai

Java SDK — on Maven Central

The core Java client and the LangChain4j content filter compile and ship in the published build in packages/java-sdk. The LangChain4j chat-model listener and the Spring AI adapters (auto-configuration / interceptor / guardrail advisor) are experimental and currently excluded from the published build — they were written against API versions that have since drifted and are being reconciled before they re-enter the build. Published to Maven Central — group ID ai.evalguard, artifact evalguard-sdk, latest 1.1.0 (via the Sonatype Central Portal; legacy OSSRH was sunset 2025-06-30). Add the coordinate to your pom.xml/Gradle build, or vendor the source from packages/java-sdk.

Targets parity with Arize AX's Java story (LangChain4j + Spring AI); the Spring AI path lands once the drifted adapters are reconciled. Closes the JVM gap surfaced in our 2026-05-22 competitive audit.

Need another language?

C# / .NET, Ruby, Rust, and PHP SDKs are not published yet. The REST API works from any language — see the API reference. If you need a native SDK, email support@evalguard.ai and we'll publish on request — typical turnaround is under a week for languages where we already have an internal client.

Why these names

The product is called EvalGuard. The domain is evalguard.ai. Industry convention (e.g. openai, @anthropic-ai/sdk, stripe, @vercel/*) keeps package names brand-only — they don't repeat the TLD in the package handle. The canonical install paths above follow that convention. The Java ai.evalguard groupId is the standard Maven reverse-DNS pattern and is unrelated to the npm/PyPI brand handle.

Pin the canonical names in your lockfile and CI. If a build pulls a bare evalguard from npm or PyPI, it is not an EvalGuard package — fail the build and report it to security@evalguard.ai.

Troubleshooting

The failures we see most often after install, and the one-line fix for each.

SymptomCauseFix
Types/exports missing; EvalGuard not foundInstalled the bare evalguard impersonator instead of the scoped packageReinstall the canonical name: @evalguard/sdk (npm), evalguardai (PyPI)
ModuleNotFoundError: No module named 'evalguard'The pip package is evalguardai, but the import name is evalguardpip install evalguardai, then from evalguard import EvalGuardClient
SDK throws EvalGuard: baseUrl must use HTTPS on startA non-local baseUrl was passed over http://Use https:// (only localhost/127.0.0.1 may use HTTP), or omit baseUrl to use the default

CLI: “No EvalGuard API key found.” The @evalguard/cli reads its key from the EVALGUARD_API_KEY environment variable or from ~/.evalguard/config.json (written by evalguard login). If neither is set, project-scoped commands fail with:

terminal
# Either log in once (persists to ~/.evalguard/config.json, mode 0600):
evalguard login --key eg_live_...

# …or export the key for the current shell:
export EVALGUARD_API_KEY=eg_live_...

# Error when neither is set:
#   No EvalGuard API key found. Run `evalguard login --key <key>` or set EVALGUARD_API_KEY.

The SDK constructor takes the key as an explicit apiKey argument (it does not read the environment for you) — EVALGUARD_API_KEY is a CLI convenience. Pass it yourself: new EvalGuard({ apiKey: process.env.EVALGUARD_API_KEY! }).