Skip to main content
There are five ways to integrate with Phosra. They are not tiers of the same product — each one exists for a different job. Pick the row that matches what you are building; every path has a copy-paste quickstart that runs against the live sandbox with no account. This page replaces reading Architecture, Partner Integration Overview, and SDK Overview end-to-end just to figure out where to begin.

​
Start with one question

What are you doing with child-safety rules?

Writing rules for a family

You build a parental-controls or safety app. A parent grants consent; you write age-appropriate rules on the family’s behalf. → Provider path (@phosra/link)

Enforcing rules in an app

You run an app, OS, router, or school network. You receive signed rule profiles and enforce them locally. → Platform path (@phosra/gatekeeper)

Just calling the API

You want raw HTTP from any language — no SDK, no framework. → Direct REST

Wiring an AI agent

You want Claude, GPT, or another MCP-compatible agent to create families, set policies, and read enforcement state through tools. → MCP server (@phosra/mcp)

Building on the open protocol

You need the vendor-neutral OCSS crypto primitives — sign/verify receipts, sealed envelopes, the Trust List — with no Phosra account and no lock-in. → OCSS protocol SDK (@openchildsafety/ocss)

​
The five paths at a glance

PathPackageBest forYou writeFirst call effortStart here
Provider@phosra/link 0.1.2Parental-control vendors that issue rules & consentTypeScript~15 minProvider quickstart →
Platform@phosra/gatekeeper 0.2.2Apps, OSes, routers, schools that enforce rulesTypeScript~15 minPlatform quickstart →
Direct RESTnone — plain JSON over HTTPSAny language, quick scripts, backendscurl / Python / Go / any5 minQuickstart →
MCP server@phosra/mcp 0.4.0AI agents & assistants (Claude, GPT, MCP clients)agent config~5 minMCP Server →
OCSS protocol SDK@openchildsafety/ocss 0.1.3Anyone who wants the open crypto primitives, provider-neutralTypeScriptvariesProtocol SDK →
Every version above is verified against the public npm registry. @phosra/link, @phosra/gatekeeper, @phosra/mcp, and @openchildsafety/ocss are all live and installable today. The native iOS and Android enforcement SDKs are distributed privately (not on npm/Maven yet) — see iOS SDK / Android SDK.

​
How the paths relate

Most of the paths are complementary, not alternatives. A real deployment usually combines two:
  • A Provider app (@phosra/link) writes rules → the hosted census distributes them → a Platform (@phosra/gatekeeper) enforces them. Two halves of the same flow.
  • Direct REST and the MCP server are two different front doors to the same control-plane API. Pick REST for code, MCP for agents.
  • The OCSS protocol SDK sits underneath both @phosra/link and @phosra/gatekeeper — they re-export its signing and verification primitives. Use it directly only if you want the raw protocol with no Phosra-specific helpers.

​
Not sure yet? Try the fastest path first

The Direct REST path returns a real 201 in one call with no account and no key. Run this against the live sandbox to see a family, child, policy, and rules materialize — then decide which SDK you want on top: 
curl -X POST https://phosra-api-sandbox-production.up.railway.app/api/v1/setup/quick \
  -H "Content-Type: application/json" \
  -d '{"child_name":"Emma","birth_date":"2016-03-15","strictness":"recommended"}'
Real response from the sandbox (trimmed): 
{
  "family": { "id": "7e1e2a77-1c5c-436d-9fc7-0d3b5bf4fc90", "name": "Emma's Family" },
  "child":  { "id": "65e1f14f-9d0a-491c-9108-bd6223a59778", "name": "Emma", "birth_date": "2016-03-15T00:00:00Z" },
  "policy": { "id": "8fd80f2d-6c29-4dcb-bcd1-a4794f8ded4e", "name": "Emma's Protection Policy", "status": "active" },
  "rules":  [ /* age-appropriate rules for a preteen */ ]
}
The full zero-to-enforcement version of this call — in curl, TypeScript, Python, and Go — lives in the Quickstart. Every tab is copy-paste and runs against the same open sandbox.

​
Decision checklist

Still torn between two paths? Match the strongest statement below:
  • “A parent needs to authorize me before I can act.” → Provider (@phosra/link) — it runs the consent ceremony and signs your rule-write directives.
  • “I need to block or allow content on a device, in real time, offline-safe.” → Platform (@phosra/gatekeeper) — it verifies the signed profile once and decides locally with isAllowed(), fail-closed, zero per-decision network calls.
  • “I just need to script family/policy setup from my backend.” → Direct REST — no SDK, any language.
  • “An LLM agent should drive this.” → MCP server.
  • “I want the open standard’s crypto, and I might swap providers later.” → OCSS protocol SDK — identical across every OCSS-conformant implementation.

​
Next steps

Quickstart — first call in 5 min

Zero to an enforced policy against the live sandbox, no key.

Architecture overview

The control plane vs the data plane vs the open OCSS protocol — one mental model.

Partner Integration Overview

Provider and Platform roles in depth, plus the pricing boundary.

Example apps & starters

Runnable end-to-end starters and every clonable example repo.