SDK Overview

Choose an SDK

Every SDK covers the same invariants. Differences are in the higher-level extras: framework adapters, orchestrator operators, agent framework integrations, and native server middleware.

Per-Language References

• TypeScript. @chio-protocol/sdk, Node 22+, ESM-only. Invariants, transport, session, DPoP, and receipt query. Express, Fastify, and Elysia integrations ship as separate packages (@chio-protocol/express, /fastify, /elysia) built on the sidecar @chio-protocol/node-http core.
• Python. chio-sdk, pure Python, no native deps, imported as chio. ChioClient, ChioSession, OAuth/PKCE helpers, plus separate companion packages (chio-fastapi, chio-langchain, and more) for framework and orchestrator integrations.
• Go. Module path github.com/backbay-labs/chio/sdks/go/chio-go, pure Go, CGO_ENABLED=0. Context-aware client, session, transport, invariants, and a nested callback router.
• Rust. The chio-binding-helpers crate is the pure invariants layer that every other SDK conforms against. chio is the CLI binary name, not a Rust library crate.
• Bindings API. The shared low-level contract that every binding must implement: canonical JSON, hashing, signing, receipt/capability/manifest verification, delegation chains, Merkle proofs, and the stable error taxonomy.

Platform SDKs

Beyond the four language SDKs, Chio ships platform-level integrations that evaluate infrastructure requests. Each one talks to a chio sidecar over POST /chio/evaluate, enforces the returned verdict, and attaches the signed receipt to the response.

• chio-tower. A Rust tower::Layer that wraps any Tower or Axum HTTP service. Exports ChioLayer, ChioService, ChioEvaluator, EvaluationResult, ChioTowerError, extract_identity, and IdentityExtractor. Fail-closed by default.
• Kubernetes controller. A validating webhook that enforces a chio.world/capability-token annotation on admitted pods (skippable with chio.world/exempt: "true"), a mutating webhook that injects a sidecar on the chio.world/inject annotation, and a namespace-scoped ChioPolicy CRD. Additional pod annotations tune the injected sidecar: chio.world/required-scopes, chio.world/sidecar-image (override the default ghcr.io/backbay-labs/chio-sidecar:latest), chio.world/upstream, chio.world/spec-path, and chio.world/receipt-store.

Additional platform and language families ship in the same repository: JVM (chio-sdk-jvm, chio-spring-boot, chio-streaming-flink), C++ (chio-cpp, chio-cpp-kernel, chio-drogon), .NET (ChioMiddleware), Swift, and AWS Lambda (chio-lambda-python, chio-lambda-extension).

Shared functionality

Every SDK ships the same pure verification functions. Higher-level features vary by language: Rust provides invariants only; TypeScript also provides transport, client and session, receipt-query, and DPoP APIs.

• Invariants. Pure functions for canonical JSON, SHA-256, Ed25519, and verification of receipts, capabilities, and signed manifests. They make no network calls. All four SDKs.
• Transport. Streamable HTTP MCP transport with session lifecycle.
• Client / Session. High-level API for opening a session against a chio edge and calling tools. A high-level Rust client is planned.
• Receipt query. Typed client over GET /v1/receipts/query with pagination. TypeScript and Python today; planned for Go and Rust.
• DPoP. Proof construction and signing bound to a capability, tool, and action-arg hash. TypeScript today; planned for the other languages.

Framework adapters and server middleware ship as separate packages per language: Express, Fastify, and Elysia for TypeScript, the companion PyPI packages for Python, and chio-go-http for Go. Rust HTTP integrations live in the platform SDKs (chio-tower).

Cross-Language Conformance

All four SDKs pass the same conformance test suite. The suite verifies identical behavior for canonical JSON, hashing, signature verification, receipt parsing, capability parsing, and manifest parsing across every language. Rust is the reference; the other SDKs produce byte-identical output against its test vectors.

# Run conformance per SDK
$ cd sdks/typescript/chio-ts && npm test
$ cd sdks/python/chio-py && pytest
$ cd sdks/go/chio-go && go test ./...
$ cargo test -p chio-binding-helpers

Next Steps

• Pick your language on the right and jump into its SDK reference.
• Read the Bindings API if you are porting to a new language or writing an offline verifier.
• Skim the Receipt Format and Receipt Query API for the data shapes each SDK wraps.