SDKs, CLI and MCP server
Install the AbuseZero Node.js SDK, browser SDK, CLI and MCP server from one npm package, abusezero.
AbuseZero ships as one npm package, abusezero. It contains the AbuseZero Node.js SDK, the AbuseZero browser SDK, the AbuseZero CLI and a local MCP server. All four are built on the same request contracts as the AbuseZero REST API, so a field means the same thing wherever you send it. Everything the package needs ships inside it, so installing it adds no other dependencies to your project.
npm install abusezeroEntry points
The package has no root import. Import the entry point for the runtime your code runs in.
| Entry point | Runtime | Use it to |
|---|---|---|
abusezero/server | Node.js 22 or later, as an ES module or CommonJS | Evaluate claims, report outcomes and manage your workspace from your backend. See Evaluations and Outcomes. |
abusezero/browser | Browsers, through your bundler, as an ES module | Run browser protection and the bot check on your pages. |
abusezero command | Node.js 22 or later | Work with AbuseZero from a terminal, a script or CI, and run a local MCP server. |
| Standalone script | Browsers, without a bundler | Add browser protection to pages that load scripts directly. |
Keep abusezero/server and your secret keys in your backend. The browser entry point never loads
server code, credentials or Node.js modules, so nothing from your backend reaches a visitor's browser.
import { AbuseZero } from "abusezero/server";import { init, observe } from "abusezero/browser";<script type="module" src="https://abusezero.com/sdk/abusezero-browser-0.11.0.js?key=pk_…"></script>Versions
The current version is 0.11.0. Every version works with REST API v1.
Within v1, responses can gain new fields and new values, such as reason codes and skip reasons. Write your integration to accept a value it doesn't recognize. Each reference page says how to handle unknown values for its fields.
The standalone script's address includes its version. When you upgrade the package, update the script address on your pages to the same version. AbuseZero reports pages running a version it no longer accepts as sdk_outdated in Developers → Browser setup.
Upgrade to 0.11.0
- Browser: update the AbuseZero browser SDK or the standalone script address to
0.11.0. AbuseZero refuses browser data from earlier versions, which reportsdk_outdated. - AI agents:
verifyAgentRequest()returns an opaqueAgentEvidencetoken. Send it unchanged asagent_evidence. Evidence from earlier versions is refused withAGENT_EVIDENCE_OUTDATED. - Previews:
previewEvaluation()results no longer includesignals. Read signal family assessments fromevaluationEvidence()or the dashboard. - Scores:
risk.scoremoves in steps of 5, and a custom policy'srisk_thresholdmust be a multiple of 5. See Policies and rules.
Upgrade to 0.10.0
- Keys: keys start with
sk_,rk_orpk_. Keys created before this version no longer work, andnew AbuseZero()rejects them withINVALID_KEY. Create new keys in Developers and replace them in your app. See Keys and access. - Browser sites: AbuseZero accepts browser data only from HTTPS sites in your site list. Check the list in Developers → Browser setup, or with
GET /v1/browser-collection. - CLI: run
abusezero loginagain. Sign-ins saved by earlier versions no longer work. One sign-in now covers every command. - MCP: reconnect each AI app to
https://mcp.abusezero.com/mcpand sign in again, as in Connect an AI app to the MCP server. - From
@abusezero/sdk: change imports toabusezero/serverandabusezero/browser, and replace theabusezero-mcpcommand withabusezero mcp.
License
The package is proprietary. Its license ships with it as LICENSE, and third-party notices as THIRD-PARTY-NOTICES.
Next steps
How is this guide?
Last updated on