Avanor Docs

Auto-Discovery

Add one flag to your start command and every LLM call site in your app shows up in your Avanor Inventory. No code changes, no instrumentation to write.

What it does

The auto-discovery rail registers itself before your application code loads, patches the vendor SDKs you already import (openai, @anthropic-ai/sdk, and others), and reports each LLM call site it sees to Avanor. Those call sites populate your Inventory, the discover step of the discover, govern, prove loop. This is the path that fills an empty Inventory: until something is connected, Avanor has nothing to map.

1. Install the SDK

One package. You do not import it in your code for auto-discovery; you load it with a Node flag (next step).

bash
npm install @avanor/sdk

2. Load it with one flag

Node evaluates the --import module to completion before it loads your app, so the vendor SDK patches are in place before your first import openai resolves. There is nothing to add to your source.

start commandbash
# Add one flag to however you already start your app.
node --import @avanor/sdk/auto your-app.js

If you cannot change the start command, set it on the environment instead. Both forms are equivalent.

bash
# Or, when you cannot edit the start command (Docker, PM2,
# a process manager), set it on the environment instead.
NODE_OPTIONS='--import @avanor/sdk/auto' node your-app.js

3. Set your API key

AVANOR_API_KEY binds every discovered call site to your tenant, resolved server-side. Without it the rail loads but emits nothing and logs a warning at startup. Mint a key at /dashboard/settings/api-keys.

bash
# Required: binds discovered call sites to your tenant, server-side.
export AVANOR_API_KEY=ak_live_...

# Optional: a human-readable environment label on every record.
export AVANOR_ENVIRONMENT=production   # defaults to NODE_ENV, then 'development'

# Optional: name the service the call sites belong to.
export AVANOR_SERVICE=broker-portal

4. See your AI footprint

Start your app and exercise a code path that calls an LLM. Within a few seconds your Inventory lists each discovered call site: the provider, the model, and where in your code it runs. From there you can author a policy to govern it.

Privacy defaults

Auto-discovery reports the shape of your AI usage, not its contents. Prompt and completion text is never captured unless you explicitly opt in with both AVANOR_CAPTURE_CONTENT and OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT. The defaults are safe for production.

  • AVANOR_DRY_RUN — emit only the periodic self-report audit, no per-call detail. Useful for a first dry run in a sensitive environment.
  • AVANOR_SDK_DISABLE — force the rail to no-op at process start, even when the flag is loaded.

Requirements

Node 18.19 or newer (18.19+, 20.6+, or 22+) for the ESM loader hook. On older Node the rail falls back to a network-level catch-net, so discovery still works; the ESM patch path is best-effort on top of it. CommonJS apps are supported through the require fallback.

Next

  • Quickstart — the explicit allow() and attest() path for enforcing policy and writing audit-grade evidence.
  • API Reference — every public type and method.