Secure Your First AI Agent in 10 Minutes
End-to-end walkthrough on the Free tier: sign up, add your own AI provider key (BYOK is included on every plan), create a governed agent and copy its gateway token, connect your agent with a one-line base URL change, and see governance results in your audit trail.
What you will build
By the end of this guide, you will have a Python AI agent running through Clevername's governance layer. Every request your agent makes will be scanned by CleverGuard — pattern matching plus the ML classifiers — for prompt injections, PII, and secrets, with full audit logging. (LLM deep-scan is a further tier, currently in beta.) No SDK required. Just a base URL change and a gateway token. Everything in this guide works on the Free tier.
What you need
- An email address (for signup)
- An API key from Anthropic, OpenAI, or Google
- Python 3.10+ with
pip
Create your account
Go to clevername.net and click Get Started. Enter your email and a password. Check your inbox for the verification email and click the confirmation link.
Add your AI provider key
In the dashboard, go to Settings → Keys. Click Add Key, select your provider (Anthropic, OpenAI, or Google), and paste your API key. Clevername stores it in GCP Secret Manager — the raw key is never stored in the database.
Create an agent and copy its gateway token
Go to Agents in the sidebar and click Create Agent. Clevername issues that agent a cn-live-*gateway token automatically — this is what your code will use to authenticate, and it is what ties every request back to a governed identity. If you only need a token for a script rather than a governed agent, Settings → Keys → Personal Access Keys issues cnk_* keys, which the gateway also accepts.
cn-live-a1b2c3d4e5f6g7h8i9j0...
Install the Guard CLI (optional)
If you use Claude Code, Cursor, VS Code, or Windsurf, install the Guard CLI to get security scanning in your IDE too:
npm install -g clevername clevername guard setup claude-code --token cn-live-your-token-here # or: cursor, windsurf, vscode
Install Python dependencies
pip install langchain-openai openai
LangChain example
Change two things in your LangChain code: the base_url and the api_key. No session headers, no registration call — that's it. Your token carries agent identity automatically.
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(
model="claude-sonnet-5", # or gpt-4o, gemini-pro, etc.
base_url="https://clevername.net/api/hub/v1",
api_key="cn-live-your-token-here", # pragma: allowlist secret
)
# Use it exactly like before
response = llm.invoke("Summarize the key benefits of agent governance.")
print(response.content)That is it. Your LangChain agent now runs through CleverGuard. Every message is scanned for prompt injections, PII, and secrets before reaching the AI provider.
CrewAI example
For CrewAI, set the environment variables and CrewAI routes through Clevername automatically:
import os
from crewai import Agent, Task, Crew
os.environ["OPENAI_API_BASE"] = "https://clevername.net/api/hub/v1"
os.environ["OPENAI_API_KEY"] = "cn-live-your-token-here" # pragma: allowlist secret
researcher = Agent(
role="Research Analyst",
goal="Find and summarize key information",
backstory="You are an expert researcher.",
llm="claude-sonnet-5",
)
task = Task(
description="Summarize the benefits of AI agent governance.",
expected_output="A 3-bullet summary.",
agent=researcher,
)
crew = Crew(agents=[researcher], tasks=[task])
result = crew.kickoff()
print(result)OpenAI SDK example
from openai import OpenAI
client = OpenAI(
base_url="https://clevername.net/api/hub/v1",
api_key="cn-live-your-token-here", # pragma: allowlist secret
)
response = client.chat.completions.create(
model="claude-sonnet-5",
messages=[
{"role": "user", "content": "What is agent governance?"}
],
)
print(response.choices[0].message.content)Check the results in your dashboard
Go back to the Clevername dashboard and check:
- Agents → Audit— your call is logged here with model, tokens used, cost, the agent identity that made it, and the scan verdict. This is the verification surface on every plan, including Free.
- Agents → Overview— open the agent you just created to see its health score and the guardrail profile its traffic is being measured against
What You Should See
After running your first governed agent call, the terminal output looks normal — you get the same response you would without Clevername. The difference is what happens behind the scenes:
Your prompt was checked for injection attacks, PII, and leaked secrets before reaching the AI provider.
The AI response was scanned for PII, secrets, and policy violations before being returned to your code.
The call is recorded with timestamp, model, token count, agent identity, and scan verdict — retained 7 days on Free, 30 on Pro, 365 on Team, unlimited on Enterprise.
Each call updates the agent's learned baseline. Behavior that diverges from the agent's approved scope (tools, hours, sensitivity, modality) raises a drift alert.
Next Steps
- Submit for Agent Review — submit your agent from AI Company → Agents to compile a full guardrail profile enforced at runtime.
- Configure guardrails— customize PII handling, injection sensitivity, and tool restrictions in Guardrail Profiles.
- Set up drift detection— get alerts when your agent deviates from its governed behavior. See Drift Detection.
- Connect your IDE — install the Guard CLI to get the same security scanning in Claude Code, Cursor, or VS Code.