What is Splyntra?
Splyntra is observability + security for AI agents. It gives teams building with LLMs and autonomous agents a single place to see what their agents did, how much it cost, and whether anything risky happened — built on open standards and shipped as a source-available core with a managed cloud on top.
Traditional APM tools were designed for request/response services. Agents are different: a single run fans out into planning steps, tool calls, retrievals, and sub-agent handoffs, each carrying free-form text that may contain secrets, PII, or an injected instruction. Splyntra treats the agent run as the first-class unit and attaches both performance and security signal to every span within it.
The unified trace + risk pillar
The core idea in Splyntra is that observability and security are the same data viewed two ways. One OpenTelemetry-native pipeline ingests your agent's spans, and Splyntra layers two things on top of every trace:
- Traces — the full, hierarchical timeline of an agent run: prompts, model calls, tool invocations, retrievals, and handoffs, with latency, token counts, and cost on each span. See Traces & risk.
- A risk score — a single 0–100 signal per run that combines secret/PII detection, prompt-injection detection, content moderation, and policy violations, mapped down onto the exact spans where the risk appeared. See The risk score.
Because both live on the same spans, you can jump from "this run scored 82/100 for risk" straight to the tool call that leaked an API key — no separate SIEM, no correlation guesswork.
Splyntra ingests OTLP directly — point your exporter at the collector and LLM spans, token counts, and model names are picked up from the GenAI semantic conventions. See Ingest & OTLP.
The five pillars
| Pillar | What it does | Where |
|---|---|---|
| Observability | Traces, agent replay, trace-correlated logs, metrics, and cost analytics. | Platform |
| Security | Secret + PII detection, content moderation, tool-guard, and prompt-injection — folded into one risk score, with an inline block/redact guard. | Security |
| Evaluation | Datasets, scorers, version-over-version regression, and a CI gate via the splyntra CLI. | Evaluation |
| Governance | Append-only audit ledger, a policy engine (RBAC/ABAC/ReBAC), delegation, spend controls, and compliance reports. | Governance |
| Agent identity | Registered agents with scoped credentials, cross-agent trust policies, and OIDC federation. | Agent identity |
Two SDKs, one collector
Instrument in one line from Python (pip install splyntra) or TypeScript /
JavaScript (npm install @splyntra/sdk), or send raw OpenTelemetry from any
language. All three speak the same OTLP endpoint.
- Quickstart — first trace + risk score in minutes.
- Python SDK · TypeScript SDK — full reference.
- Integrations — LangGraph, CrewAI, OpenAI Agents, LlamaIndex, MCP, and OpenAI-compatible providers (Grok, Gemini, Groq, OpenRouter, …).
Editions
Splyntra is built from a single source-available core into three editions. Feature gating is done through build-time registration seams and configuration — never forked code — so the core builds, runs, and is genuinely useful on its own.
| Edition | What it is | License |
|---|---|---|
| Community | The source-available core: OTel collector, traces, logs, metrics, cost analytics, detection, evaluation, and the dashboard. Self-hosted, free forever. | FSL-1.1 (→ Apache 2.0) |
| Enterprise | Community plus governance, agent identity/federation, SSO/SCIM, and advanced scorers. Self-hosted. | Commercial |
| Cloud | Fully managed Splyntra with the Enterprise feature set, multi-tenant orgs, and per-plan gating. | Commercial |
See Editions & licensing for the full matrix, and Splyntra vs. alternatives for how it compares to LangSmith, Langfuse, Arize Phoenix, Helicone, and Braintrust.
Who it's for
- AI/agent engineers who need to debug multi-step runs and understand latency and cost.
- Platform teams standardizing agent observability across many teams and frameworks.
- Security & compliance teams who need detection, an audit trail, and enforceable policies before agents touch production data.
Next steps
- Quickstart — instrument an agent and see your first trace + risk score.
- How it works — the architecture and data flow.
- Self-hosting — run the core with
docker compose up.