fullcourtdefense-agent

FullCourtDefense checks every tool call of an AI agent against your organisation's action policy before the tool runs. This package is the small agent hook: standard library only (no httpx, requests or openai), so adding it to a deployed agent does not change the versions of anything the agent already uses.

Install

Pin it exactly. Do not add --hash: pip's hash checking is all-or-nothing, so one hashed line makes every other line of the file need a hash too, and an agent's unpinned requirements stop building.

fullcourtdefense-agent==0.2.2

Configure

A monitor-mode shield never blocks and never waits: the tool runs at once and the call is recorded in the background.

Use

from fullcourtdefense_agent import ToolGate, ToolCallBlocked

gate = ToolGate.from_env()

# A function, checked before every call (sync or async def):
safe_refund = gate.protect(issue_refund, operation="refund")

# Or one call:
gate.guard_tool_call("issue_refund", lambda: issue_refund("o_1", 120),
                     tool_args={"order": "o_1", "amount": 120}, operation="refund")

A blocked call raises ToolCallBlocked; the tool did not run.

A wrong key, a refused or unknown shield, a refused request (HTTP 401 / 403 / 404 / 400) is not an outage. The fail mode does not apply: the tool does not run, the check is not reported later as "ran without a check", and FullCourtDefenseApiError (a ToolCallBlocked with status and code: FCD_UNAUTHORIZED, FCD_FORBIDDEN, FCD_SHIELD_NOT_FOUND, FCD_BAD_REQUEST) says what to change. It is also logged once on the fullcourtdefense logger. Any other 4xx except 408 / 429 (a 413, for example) is answered the same way. Only a real outage (no answer, 5xx, 408, 429) is answered by the fail mode.

On a monitor shield (owner decision O4) a refused key or shield does not stop the tool: the mode the gate knows (a live answer earlier in the process, else FCD_MODE_AT_PROTECT) is monitor, so the tool runs and the call is still reported, and FullCourtDefense raises a "wrong or missing shield key" alert. With no known mode the shield is treated as block.

Arguments too deep or too large to check (nested deeper than 32 levels, more than 20,000 values) are never sent: in block mode the call is stopped (ToolCallBlocked, "too large to check safely"), in monitor mode it runs and the record says what was not sent. Never an outage.

OpenAI Agents SDK and LangChain

from fullcourtdefense_agent.frameworks import protect_openai_agents_tool, protect_langchain_base_tool

agent = Agent(name="support", tools=[protect_openai_agents_tool(gate, lookup_customer)])  # still a FunctionTool
safe_sql = protect_langchain_base_tool(gate, sql_query)                                   # still a BaseTool

The full SDK (pip install fullcourtdefense) does the same with fcd.protect(tool).

Google ADK

from google.adk.apps import App
from fullcourtdefense_agent.adk import FcdToolGuardPlugin

app = App(name="billing", root_agent=root_agent, plugins=[FcdToolGuardPlugin()])

A blocked call is answered to the model as {"blocked": true, "reason": "...", "by": "FullCourtDefense"} and the tool does not run. Gemini's built-in tools (Google Search, built-in code execution, Vertex AI Search grounding) run inside Google and are not checked.

Start-up hook (no code change)

The wheel installs fullcourtdefense_agent_autoguard.pth into site-packages. Python runs its one line at start-up. Without FCD_AUTOGUARD it only reads that variable and stops. With FCD_AUTOGUARD=adk it waits for google.adk.runners to load and adds the plugin to every Runner the process creates, after the agent's own plugins. Security scanners flag start-up lines in .pth files as a supply-chain technique; this one is disclosed here, pinned by exact version and inert unless the variable is set. If the plugin cannot be added (an unsupported ADK version), the hook logs an error on the fullcourtdefense logger and stderr; it never stops the agent from starting.

What leaves the agent

The tool name, the operation, the agent identity, the session id and the tool arguments (the policy input; the server minimises them before storing). Never the tool's result and never the text of an error the tool raised.