AgentGuard — Python SDK

Runtime guardrails and observability for LLM and agent applications.

One call to init() instruments your provider clients. Every LLM call is then scanned against the guardrails you configure in the AgentGuard console, and traced — prompts, responses, token usage, cost, and any guardrail that fired.

pip install actaclad-agentguard

import agentguard

agentguard.init(
    public_key="pk-...",
    secret_key="sk-...",
    base_url="https://your-agentguard-host",
    project_id="your-project-id",
)

That is the whole setup. Your existing OpenAI, Anthropic, Gemini or LiteLLM calls are now guarded and traced — no call sites change.

Scoping a request

policy() attaches identity to the work inside it and opens the trace, so an agent run is one trace rather than a scatter of unlinked calls.

with agentguard.policy(
    user_id="u-123",
    session_id="s-456",
    feature="support-triage",
    metadata={"tenant": "acme"},
):
    answer = my_agent.invoke(question)

Everything inside — guarded LLM calls, tool calls, agent steps — lands in one trace, with the identity recorded once at the top and filterable in the console.

Agent frameworks

LangChain and LangGraph are traced automatically inside a policy() scope. No callback wiring:

with agentguard.policy(user_id=user_id, feature="triage"):
    agent.invoke({"messages": [{"role": "user", "content": question}]})

Pass the handler yourself only if you want to — agentguard.langchain_handler(). Opt out with policy(autotrace=False).

Tools are guarded automatically. LangChain tools (including LangGraph's ToolNode) and CrewAI tools get a permission check, and their arguments and results are scanned. For MCP, instrument the client session:

from agentguard.mcp import instrument_mcp_client   # pip install "actaclad-agentguard[mcp]"
instrument_mcp_client(session)

Other frameworks:

agentguard.instrument_crewai()          # pip install "actaclad-agentguard[crewai]"
agentguard.instrument_openai_agents()   # pip install "actaclad-agentguard[openai-agents]"

Guardrails

Guardrails are configured server-side per project and enforced in the SDK, so a policy change takes effect without a redeploy.

To try a policy before you enforce it, use observe mode (1.7.0+). Every guardrail runs and records what it finds, but nothing is blocked; the console shows those findings as WOULD BLOCK. Redaction still applies.

agentguard.init(project_id="...", guardrails="observe")   # "auto" enforces

A kill switch in the console blocks every model call in the project. The SDK checks it every 10 seconds, so it works without a redeploy.

Azure, Bedrock and Vertex clients (sync and async) report their real provider: azure, bedrock or vertex. List those models under the matching provider in the Allowed Model List.

A blocked call raises, so you can handle it explicitly:

try:
    with agentguard.policy(user_id=user_id, on_block="raise"):
        answer = my_agent.invoke(question)
except agentguard.AgentGuardBlocked as blocked:
    answer = "Sorry — I can't help with that."

Use on_block="refuse" to get a safe refusal response instead of an exception.

Configuration

Credentials can come from the environment instead of init() arguments:

Other init() options: guardrails (auto, observe or off), environment (a label on traces), on_block (raise or refuse), tracing (batch or realtime), streaming, poll_interval (seconds, default 900), kill_switch_poll_interval (seconds, default 10).

API

Optional extras

pip install "actaclad-agentguard[gemini]"          # google-genai
pip install "actaclad-agentguard[anthropic]"
pip install "actaclad-agentguard[langchain]"       # LangChain / LangGraph
pip install "actaclad-agentguard[mcp]"             # MCP tools

Guardrails need no extra install.

The base install keeps dependencies small; each extra is pulled in only when you need it.

Notes

• Where checks run. PII, prompt injection and toxic content are scored by your AgentGuard host, in one call per step; the text is scanned, not stored. Budget and rate limits check server-side counters so limits hold across every instance of your service. Everything else runs in your process. The block decision is always made in your process.
• If AgentGuard can't be reached, PII, injection and toxicity checks let the call through and log a warning.
• Content capture is off by default. Prompts and responses are only recorded when AGENTGUARD_CAPTURE_CONTENT=true.
• Failures degrade, they don't break. If telemetry or config polling fails, your application call still runs.

© ActaClad Technologies. See the AgentGuard console for documentation and project settings.