Semantic Kernel Integration

Add trust verification to Microsoft Semantic Kernel using the TruthVouch Trust API. Automatically verify LLM outputs for factual accuracy and attach trust scores to kernel function results.

Installation

dotnet add package TruthVouch.SemanticKernel

Requires .NET 9.0+ and Microsoft.SemanticKernel >= 1.34.0.

Quick Start

Register TruthVouch directly on your IKernelBuilder. This wires in both the function invocation filter and the prompt render filter automatically:

using TruthVouch.SemanticKernel;

var kernel = Kernel.CreateBuilder()
    .AddOpenAIChatCompletion("gpt-4o", openAiApiKey)
    .AddTruthVouch(o =>
    {
        o.ApiKey         = "your-truthvouch-api-key";
        o.TrustThreshold = 0.75;
        o.ThrowOnLowTrust = true;
    })
    .Build();

If you use a plain IServiceCollection (e.g., ASP.NET Core):

builder.Services.AddTruthVouch(o =>
{
    o.ApiKey         = "your-truthvouch-api-key";
    o.TrustThreshold = 0.8;
});

Components

TruthVouchPlugin

A Semantic Kernel plugin that exposes fact-verification as a first-class kernel function (verify_content). The function accepts a text string and an optional verification mode, calls the TruthVouch Trust API, and returns a structured VerifyResponse containing the trust score and per-claim verdicts.

Add the plugin to your kernel to let the AI planner invoke it on demand:

kernel.Plugins.AddFromObject(kernel.Services.GetRequiredService<TruthVouchPlugin>(), "TruthVouch");

TruthVouchFilter

Implements IFunctionInvocationFilter. After every kernel function call that returns a string, this filter automatically sends the output to the Trust API and:

Attaches truthvouch_trust_score and truthvouch_verification_id to the FunctionResult metadata on every call
When the score falls below TrustThreshold and ThrowOnLowTrust is false, logs a warning and adds a truthvouch_warning key to the result metadata
When ThrowOnLowTrust is true, throws a TrustVerificationException

Functions decorated with [SkipTruthVerification] are bypassed entirely.

TruthVouchPromptFilter

Implements IPromptRenderFilter. When VerifyInputPrompts is true, this filter verifies the fully rendered prompt text before it is sent to the LLM. The trust score and verification ID are attached to the prompt context arguments so downstream filters can inspect them without a second API call.

Both filters are registered automatically when you call AddTruthVouch on an IKernelBuilder.

Configuration

All options are set via the TruthVouchOptions delegate passed to AddTruthVouch.

Property	Type	Default	Description
`ApiKey`	`string`	`""`	Bearer token sent with every Trust API request
`BaseUrl`	`string`	`http://localhost:5004/api/v1/trust`	Base URL of the TruthVouch Trust API
`TrustThreshold`	`double`	`0.8`	Minimum acceptable trust score (0.0–1.0). Scores below trigger warning or exception
`DefaultMode`	`string`	`spot_check`	Default verification mode when none specified. Valid: `spot_check`, `standard`, `full`
`ThrowOnLowTrust`	`bool`	`false`	When `true`, throws `TrustVerificationException` instead of logging warning on low-trust results
`VerifyInputPrompts`	`bool`	`false`	When `true`, verifies rendered prompts before they are sent to the LLM

License

Apache-2.0