404 on npm install costs a developer all their trust:- Runnable starter — a copy-paste snippet (not a repo) you can paste into a terminal right now.
It runs against
https://phosra-api-sandbox-production.up.railway.appwith no credential. Every response shown is verbatim from that live sandbox. - Clonable repo — a public GitHub repository you can
git clone. We link only repos that actually exist (verified against the GitHub API while writing this page). - Published package — on the public npm registry. Versions are verified against
npm view; pin the one you use. - Private / on-request — the native iOS & Android enforcement SDKs are distributed privately. We say so plainly and give you the contact, rather than show an install line that would 404.
Hosted Phosra Link qualification fleet
Phosra also maintains real Railway-hosted applications for end-to-end human qualification. These are not public starter repos or evidence that the private SDK candidates are published:docs/qualification/hosted-phosra-link.md defines the evidence and
rollback contract.
The 60-second starter
This is the smallest complete integration: mint nothing, create a protected child, enforce the policy, and read the result — the same four moves every Phosra integration makes. It is a snippet, not a clonable repo. It needs no API key because it targets the open sandbox.Prove the sandbox is up
Create a family + child + active policy in one call
Enforce the policy (async job)
Poll the job to completion
setup/quick returns 200, the
enforce job flips to completed in well under a second):
What the starter builds, in a real app
The four API calls above are exactly what a parental-control app runs behind its UI. Every screen below is a real screenshot captured from Propagate — a reference app built on this same sandbox API — following one child (Ruby) end to end. Nothing is mocked or drawn.
setup/quick, rendered for a human: a family with a child and a starter policy. The same call the starter's step 2 makes.

The link ceremony — the app-side equivalent of pushing a policy to a platform. It states, up front, exactly which rules the platform will apply and confirm before anything turns green.

Enforced and confirmed — the human-readable form of a verified compliance link: 'Applied & verified just now', with the applied rules listed underneath.
The catalog
Real, published integrations you can clone or install today. The two GitHub repositories below are public in thePhosra-Inc org:

The public Phosra-Inc GitHub organization — the two example repositories in the catalog below are real and clonable. Captured from github.com.
Clonable repos
Provider conformance harness
Phosra-Inc/touchstone (TypeScript, MIT). The independent OCSS conformance harness — probe a
provider enclave and print a signed report. Zero runtime dependencies.iOS Link kit (Connect sheet)
Phosra-Inc/phosra-link-kit-ios (Swift). The native-iOS Phosra Link — a branded Connect sheet
your app presents in ~10 lines, with onSuccess / onExit callbacks. The Plaid-LinkKit analog.Run without cloning — one-command samples
Each of these runs a real integration from a single command against the sandbox.MCP server for AI agents
Partner CLI — sandbox round-trip
Embeddable Connect component
OCSS protocol reference lib
Every published package
All verified against the public npm registry while writing this page — pin the version you use.@ocss/* scope exists. The open standard’s library ships under @openchildsafety/*, and
the Phosra client libraries under @phosra/*. If you see an @ocss/… install line anywhere, it
is wrong — it will 404 on npm.Private / on-request
The native on-device enforcement SDKs are not on a public registry yet — we distribute them privately rather than show an install line that would fail.phosra-link-kit-ios) —
the Connect sheet — is public and in the catalog above. The separate iOS enforcement SDK (the
one that drives FamilyControls / ManagedSettings on-device) is the private one.Reference provider integrations
The sandbox ships a built-in reference provider that powers the live OAuth consent page you meet in the Connect a platform guide and the end-to-end walkthrough. It exposes real/oauth/authorize,
/oauth/token, and /oauth/profiles endpoints with fixed demo child profiles (Mia, Leo, Ava), so
you can drive a complete connect ceremony against the sandbox without standing up your own provider.