Shipping an open-source AI interview SDK that stores nothing

How AI Interview SDK drops an AI-scored interview into any app as one React component — with your keys, your backend, your database — so the maintainer never sees a candidate's answer.

Most "AI interview" products are platforms: you send candidate answers to their servers, and you trust them with some of the most sensitive data a hiring process produces. In a space that's already had a public data breach, I wanted the opposite shape — a developer tool you install into your own app, where the person who wrote the library never sees, stores, or processes a single answer.

That's AI Interview SDK: an open-source (MIT) TypeScript/React SDK that drops a full AI-scored interview into your product as one React component — your AI keys, your backend, your database, end to end.

One component, two modes

The whole API surface is a single widget. What changes is where the AI key lives.

import '@interview-sdk/react/styles.css';
import { InterviewWidget } from '@interview-sdk/react';
import { OpenAIAdapter } from '@interview-sdk/adapter-openai';

<InterviewWidget
  questions={[{ id: 'q1', prompt: 'How do hash maps handle collisions?', concepts: ['hashing'] }]}
  rubric={[{ id: 'technical', label: 'Technical depth', weight: 1 }]}
  mode="client"
  adapter={new OpenAIAdapter({ apiKey: process.env.NEXT_PUBLIC_OPENAI_API_KEY })}
/>;

Client Mode (mode="client" + adapter) gets a real interview running today — dynamic follow-ups, semantic evaluation, rubric scoring, voice, a report — with no backend. Perfect for prototyping.
Server Mode (mode="server" + apiBaseUrl) is the same widget with two props changed. Now the AI key lives on your server, where it belongs, and the browser never touches it.

You start in Client Mode to feel it, then flip two props to ship it safely. Nothing else in your integration changes.

Scores you can prove weren't tampered with

The moment scoring happens in the browser, a candidate can open dev tools and rewrite their result. Server Mode closes that: it HMAC-signs every evaluation. Your app verifies the signature before it trusts a client-reconstructed report. A tampered score simply fails verification.

The zero-infra guarantee

This is the part I care about most. There is no maintainer-run service anywhere in the system — not for the interview, not for the testing tools, not for CI. @interview-sdk/server runs on your infrastructure. The only thing the maintainer pays for is a domain name.

That's not a marketing line; it's an architectural constraint. Because there's exactly one place that talks to a model (the adapter) and exactly one place that scores in production (your server), "we store nothing" is something you can audit, not just believe.

Not a platform

To be precise about what this is and isn't:

It is: a library you npm install and own.
It is not: an interview platform, a SaaS, or a data controller.

The trade-off is real — you bring the keys and the backend — but for candidate data, that's a feature, not a burden. It's published on npm today across a small monorepo of packages; the next post digs into the part that makes it feel like a real interview rather than a form: the follow-up engine.