🧵 Loom
English · 中文
The black box, firewall & debugger for AI agents.
Your agent ran — touched files, called tools, spent tokens — and you have no idea what it did or why. Loom records every action, replays it byte-for-byte for $0, firewalls dangerous calls before they run, and lets you step through the whole run like a debugger. Works with any Claude/OpenAI-API agent — Claude Code, LangGraph, CrewAI, your own.
pip install loom-harness # zero dependencies
loom record claude "fix the failing test" --safe
recorded 17 steps · 42k tokens → session.loom.json
🛡 firewall blocked 1 risky call: Read(".env")
🔬 loom debug session.loom.json # step through it, fork any turn live
Step through any agent run — the reasoning, the tools, the exact context the model saw, and fork any turn live.
Why Loom
- 🎥 Record any agent — proxy Claude Code / Codex / Cursor / your own, one command, zero code changes.
- ⏪ Replay for $0 — every call recorded at one boundary → byte-identical, offline. Deterministic CI for a stochastic agent.
- 🔬 Step-debug it — walk each step, see the exact context the model saw, then edit a turn and re-run it live.
- 🕸 Any multi-agent framework — LangGraph · CrewAI · AutoGen · OpenAI-Agents · Claude-SDK, recovered into one agent tree from the wire, zero code changes.
- 🛡 Firewall it — deny / confirm dangerous calls before they run, by capability (
cap:money_movement) or sequence (after Read(.env): deny network). - 🕵 Catch exfiltration — a secret flowing to an egress, even base64-encoded or paraphrased, confirmed by an LLM judge.
- ↩ Undo the world — revert the files an agent changed, or snapshot & restore a whole workspace + database.
The debugger
loom debug run.loom.json (or loom live to watch it run) opens a step-debugger in your browser:
- Step through every action — the model's reasoning, the tool call + args, the world-diff (file / SQL row / DOM), risk, tokens.
- Context frame — the exact conversation the model saw at each step: the debugger's stack & variables.
- Fork & re-run live — inject a message or switch the model at any turn; only the divergent tail costs a call, and the branch appears beside the original.
- Multi-agent tree — a supervisor/sub-agent system (yours or a third-party framework) recovered from the wire and shown as a collapsible tree, laned by agent.
- Ask & assert — send the live agent a new message, or check plain-English expectations (
never issue_refund,output contains …) as a CI gate.
loom studio <trace> freezes the whole UI into one shareable HTML file (no server, no agent).
Debug a live agent
loom live --agent app:agent # watch it run, send follow-ups, fork any turn
Behind a gRPC / HTTP endpoint? Point your server at the recording proxy and drive it from the same debugger — no code, just your grpcurl:
loom live --proxy-port 9000 \
--trigger 'grpcurl -d "{\"prompt\": $LOOM_PROMPT_JSON}" -plaintext :50051 agent.Agent/Run'
# then start your server with ANTHROPIC_BASE_URL=http://127.0.0.1:9000
Loom reconstructs the agent's full internal hierarchy even though it's behind an endpoint.
Use it as a Python harness
from loom import Agent, tool, Policy
@tool
def search(q: str) -> str:
"Search the docs."
return db.search(q)
agent = Agent(model="claude-opus-4-8", tools=[search],
policy=Policy(deny=["issue_refund*"], budget_tokens=50_000)) # in-loop firewall
run = agent.run("What changed in the API last week?")
run.replay() # byte-identical, no API calls
run.fork(at=3) # rewind to turn 3, continue live on a new branch
One effect boundary records every model + tool call — so replay, fork, free CI, human-in-the-loop, the firewall, and every analyzer fall out of the same primitive. The kernel is zero-dependency.
A few more commands
loom replay <trace> |
re-run byte-identical, $0, offline |
loom taint · loom dlp --judge |
exfiltration lineage · semantic DLP |
loom redteam run --generate <m> |
AI red-teamer — invents attacks for your tool surface |
loom mcp gateway -- <server> |
firewall + record any MCP server |
loom undo <trace> |
revert the files the agent changed |
Run loom --help for the full set — record, replay, debug, live, studio, firewall,
taint, dlp, redteam, mcp, undo, cost, rootcause, experiment, and more.
Install
pip install loom-harness # kernel + CLI, zero deps
pip install "loom-harness[anthropic]" # + live Claude
pip install "loom-harness[mcp]" # + MCP gateway
Python 3.10–3.13 · MIT · import loom
Loom shrinks an agent's blast radius and makes its behavior inspectable — it is not a guarantee a model can't misbehave. See the threat model.
1 maintainer
Metadata
1 maintainer
Release files for loom-harness 0.33.12
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| loom_harness-0.33.12.tar.gz | 2.4 MB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| loom_harness-0.33.12-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.8 MB
Release files / loom_harness-0.33.12.tar.gz
| Download URL | loom_harness-0.33.12.tar.gz |
|---|---|
| Size | 2.4 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
780dff81c313fdacf96ce2c713d11eb218312508928d09eef6c3cd9dfc8fc472
|
|
BLAKE2b-256 checksum How to use checksums |
1d08886f87082f300ba2e96536b85f2a8ca70a92d817fd60e2a88fabd66821f2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.11
|
Release files / loom_harness-0.33.12-py3-none-any.whl
| Download URL | loom_harness-0.33.12-py3-none-any.whl |
|---|---|
| Size | 396.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c043004ee0ea06ee1cef05c738809e9bb149c6c9f9eb6c4d00a3b7b5c5e77c95
|
|
BLAKE2b-256 checksum How to use checksums |
ec2f3b52984adb9b7ae34c8f38f41dab303d7e792d9bcfad10192823091ad4cd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.11
|
Security for loom-harness 0.33.12
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
