Agent Adapter

Build with any framework. Ship with one safety layer.

Write a tool once, as a plain Python function. Every call to it, from any model or agent framework, is approved, budgeted, priced and traced the same way.

LangChain, CrewAI or ADK help you build an agent. Agent Adapter makes every tool call that agent makes safe, priced and traced, in any framework or in none.

It turns your functions into LLM tools, checks their schemas once at startup, and runs every call through one executor that applies approval, budgets, guards, caching and cost tracking. The core depends only on pydantic. Every framework is an optional extra, imported lazily. No agent framework is needed: run_tool_loop with your own model is the agent loop, and Flow is the graph.

Install

Python 3.11 or later.

pip install agent-adapter                 # core (pydantic only)
pip install "agent-adapter[openai]"       # + the extras you need

Quickstart

import agent_adapter as aa


@aa.tool
def add(a: int, b: int) -> int:
    """Add two numbers."""
    return a + b


print(aa.call(add, a=1, b=2))  # 3: validated and guarded by the default executor

@aa.tool registers the function; aa.call runs it through the default executor. From async code (FastAPI, ...) use await aa.acall(add, a=1, b=2).

A tool with side effects asks a person first, once, and the approval survives a restart:

@aa.tool(confirm=True)
def refund(order_id: str, amount: float) -> str:
    """Refund an order."""
    return f"refunded {amount} on {order_id}"


executor = aa.configure(approval=aa.DeferredApproval.sqlite("approvals.db"))
try:
    aa.call(refund, order_id="o-7", amount=500)
except aa.ApprovalPending as pending:
    approval_id = pending.approval_id  # show it to a reviewer
# ... later, in any process that opens the same file:
print(executor.resume_sync(approval_id, True, decided_by="ana").value)

Why Agent Adapter

Each framework has its own tool format, its own idea of approval and no shared view of cost. Change framework, or run two, and the rules are rewritten. Agent Adapter keeps them in one place.

Works with

Features

Safe by default

• A confirm tool runs only after an approval port approves, and each decision is used once. No port: denied. A framework's own "approved" signal never counts alone.
• The HTTP server refuses to start without an authenticator unless anonymous mode is chosen.
• The local viewer and chat bind 127.0.0.1 only, behind a private token link.
• Logs never carry secrets or the arguments of confirm tools.

Command line

Licence

Apache License 2.0. Copyright 2026 Veloce AI. Documentation: https://agent-adapter.veloceai.in/