When to use the collector
Three questions in order. Stop at the first yes.
1. Are you instrumenting code you wrote?
If yes — and only that — use the SDK only. The collector is not needed.
The SDK runs in-process, captures every prompt + tool call + sub-agent spawn from your code path, and ships directly to Trefur. There's no network hop and no extra process to operate.
See SDK quickstart for the three-line install for JavaScript / Python / Go / Rust / Java / .NET.
2. Are you observing platforms you have OAuth access to?
For platforms like Google Workspace, Microsoft 365, OpenAI, Anthropic, Slack, Atlassian — connect OAuth in the web UI. No collector, no SDK, no code change.
Trefur calls the platform's audit / admin APIs on a schedule and builds a complete picture of AI activity in that environment. The integration runs entirely SaaS-side — nothing installs in your network.
See Integrations overview for the full list of supported platforms.
3. Do you need to observe something outside your code AND outside an OAuth platform?
If you need to observe any of:
- Unmanaged AI traffic from arbitrary desktop apps
- Outbound HTTP / DNS egress from a host
- Browser automation activity (Chrome / Edge / Playwright launched outside your code)
- Shell command history
- OS-level process spawn, file IO, or syscall activity
- OTel from a third-party agent you didn't write
Then install the collector. See Collector quickstart.
Surface → tool lookup
| Surface you want to observe | Right tool |
|---|---|
| LLM call from your code | SDK |
| LLM call from a desktop app you didn't write | Collector — LLM proxy |
| HTTP egress from your code | SDK fetch / axios / requests instrumentor — or collector HTTP proxy |
| DNS lookups | Collector — DNS proxy |
| Browser automation (Playwright in your code) | SDK Playwright instrumentor |
| Browser activity from arbitrary Chrome | Collector — CDP proxy |
| Shell commands | Collector — shell hook (zsh / bash / fish) |
| Process spawn / file IO / syscalls | Collector — OS layer |
| Microsoft 365 Copilot / Google Workspace AI / OpenAI Admin / Anthropic Admin | OAuth integration (no install) |
| OTel traces / metrics / logs from a third-party agent | Collector — OTel receiver (or point the producer at api.trefur.com) |
Common combinations
Tools stack — pick more than one if you need both surfaces.
- SDK + OAuth integration. Trace your own production agent (SDK) AND scan unmanaged AI activity across your Google Workspace tenant (OAuth). Most teams start here.
- SDK + collector. Trace your own agent (SDK) AND observe a desktop client like Claude Code running on the same machine (collector LLM proxy + shell hook).
- Collector only. Audit-style deployment on a host where you didn't write any of the code running — for example, observing a vendor-supplied AI workflow.
Next
- Collector quickstart — 30-second install.
- Collector inputs — what each ingest path captures.
- How telemetry reaches Trefur — the full ingest-layer matrix.