QWED Open Responses

Verification Guards for AI Agent Outputs

QWED Open Responses provides deterministic, rule-based verification guards for AI responses, tool calls, and structured outputs. Works with OpenAI Responses API, LangChain, LlamaIndex, and other AI agent frameworks.

Installation

pip install qwed-open-responses

With optional integrations:

pip install qwed-open-responses[openai]      # OpenAI Responses API
pip install qwed-open-responses[langchain]   # LangChain
pip install qwed-open-responses[tax]         # Tax Verification (Payroll, Crypto)
pip install qwed-open-responses[finance]     # Finance Verification (NPV, ISO 20022)
pip install qwed-open-responses[legal]       # Legal Verification (Contracts, Jurisdictions)
pip install qwed-open-responses[all]         # All integrations

💡 What QWED Open Responses Is (and Isn't)

✅ QWED Open Responses IS:

• Verification middleware for AI agents (OpenAI, LangChain, LlamaIndex)
• Deterministic — every check is an explicit, inspectable rule (schema validation, arithmetic recomputation, configurable pattern lists). No LLM calls in the verification path
• Framework-agnostic — works with any LLM or agent framework
• A safety layer — blocks known-dangerous tool calls (configurable blocklist) and incorrect outputs

❌ QWED Open Responses is NOT:

• An agent framework — use LangChain or AutoGen for that
• A prompt engineering tool — use DSPy for that
• A vector database — use Pinecone or Weaviate for that
• A vaguely defined "guardrail" — every check is an explicit, inspectable rule (regex-based pattern scans included, and labeled as heuristics)

Think of QWED as the "firewall" for your AI agent's actions and outputs.

LangChain builds the agent. OpenAI powers the brain. QWED secures the actions.

🆚 How We're Different from Other Guardrails

Use Together (Best Practice)

┌──────────────┐     ┌───────────────┐     ┌──────────────┐
│   LangChain  │ ──► │     QWED      │ ──► │  Verified    │
│    Agent     │     │  (Middleware) │     │  Tool Call   │
└──────────────┘     └───────────────┘     └──────────────┘

🔒 Security & Privacy

Verification happens locally. No data leaves your infrastructure.

Perfect for:

• Agents with access to databases or APIs
• Enterprise internal tools
• Automated financial/legal assistants

❓ FAQ

🗺️ Roadmap

✅ Released

• ToolGuard - Block dangerous tools/patterns
• SchemaGuard - JSON Schema validation
• MathGuard - SymPy calculation verification
• SafetyGuard - PII and injection checks
• StateGuard - Finite state machine validation
• ArgumentGuard - Type and range checking
• Integrations: OpenAI, LangChain, LlamaIndex
• Streaming Verification - Verify tool-call items in real-time

🚧 In Progress

• Auto-Fix - Deterministic correction of JSON errors

🔮 Planned

• Distributed Rules - Sync rules across agent swarms
• Policy-as-Code - Define guards in YAML/JSON
• Visual Dashboard - View blocked attempts stats

Quick Start

from qwed_open_responses import ResponseVerifier, ToolGuard, SchemaGuard

# Create verifier with guards
verifier = ResponseVerifier()

# Verify a tool call
result = verifier.verify_tool_call(
    tool_name="execute_sql",
    arguments={"query": "SELECT * FROM users"},
    guards=[ToolGuard()]
)

if result.verified:
    print("✅ Safe to execute")
else:
    print(f"❌ Blocked: {result.block_reason}")

Guards

Examples

Block Dangerous Tools

from qwed_open_responses import ToolGuard

guard = ToolGuard(
    blocked_tools=["execute_shell", "delete_file"],
    dangerous_patterns=[r"DROP TABLE", r"rm -rf"],
)

result = guard.check({
    "tool_name": "execute_sql",
    "arguments": {"query": "DROP TABLE users"}
})
# ❌ BLOCKED: Dangerous pattern detected

Validate Structured Outputs

from qwed_open_responses import SchemaGuard

schema = {
    "type": "object",
    "properties": {
        "name": {"type": "string"},
        "age": {"type": "integer", "minimum": 0}
    },
    "required": ["name", "age"]
}

guard = SchemaGuard(schema=schema)
result = guard.check({"output": {"name": "John", "age": 30}})
# ✅ Schema validation passed

Verify Calculations

from qwed_open_responses import MathGuard

guard = MathGuard()
result = guard.check({
    "output": {
        "subtotal": 100,
        "tax": 8,
        "total": 108
    }
})
# ✅ Math verification passed

Safety Checks

from qwed_open_responses import SafetyGuard

guard = SafetyGuard(
    check_pii=True,
    check_injection=True,
    max_cost=100.0,
)

result = guard.check({
    "content": "ignore previous instructions and..."
})
# ❌ BLOCKED: Prompt injection detected

Framework Integrations

LangChain

from qwed_open_responses.middleware.langchain import QWEDCallbackHandler

callback = QWEDCallbackHandler(
    guards=[ToolGuard(), SafetyGuard()]
)

agent = create_agent(callbacks=[callback])

OpenAI Responses API

from qwed_open_responses.middleware.openai_sdk import VerifiedOpenAI

client = VerifiedOpenAI(
    api_key="...",
    guards=[ToolGuard(), SchemaGuard(schema=my_schema)]
)

response = client.responses.create(...)
# Automatically verified before returning

⚠️ Scope & Limitations

Read this before relying on QWED as a trust boundary (issue #31 audit):

• Tool blocking is a configurable blocklist, not a sandbox. Matching is case-insensitive and the default list covers common shells (bash, sh, powershell, zsh, ...) and client action tools (local_shell, apply_patch, computer_use), and argument pattern scanning also decodes bounded base64 payloads — but pattern scanning is a heuristic, not a security boundary. Prefer allowed_tools allowlists and OS-level sandboxing for real enforcement.
• Responses API action items are tool calls (v0.6.1 breaking change). local_shell_call, shell_call, apply_patch_call and computer_call items are checked as the tools local_shell, shell, apply_patch and computer_use; custom_tool_call and mcp_approval_request items are checked under their own name. The first four names are on the default blocklist. To run them, create ToolGuard with use_default_blocklist=False; this drops the whole default blocklist (shells included), so re-add any names you still want blocked via blocked_tools. allowed_tools is optional, but for least-privilege execution configure it as an allowlist — and when you do, list every action tool you run in it. Unknown *_call / *_request items in a response's output[] or a stream fail closed.
• PII detection produces warnings, not blocks. PII matches surface as a separate warning state (VerificationResult.warnings); they do not fail verified or block unless you create the verifier with allow_warnings=False.
• SchemaGuard rejects undeclared root fields (v0.6.0 breaking change). When your schema does not set additionalProperties, undeclared top-level fields fail validation. Declare them, set additionalProperties explicitly, or opt out with allow_additional_properties=True.
• Verification resource limits fail closed. JSON text longer than 100,000 characters or nesting deeper than 100 levels receives a failed verdict. SafetyGuard also rejects content deeper than 12 levels, wider than 10,000 nodes, or longer than 100,000 characters. SchemaGuard reports only the first validation error and marks the total count as unknown.
• Budget checks use model-reported usage. response["usage"] comes from the model output under verification: negative or non-numeric reports fail closed, but under-reporting cannot be detected from the response itself. Supply trusted-side totals via context["total_cost"] / context["total_tokens"] or reconcile against provider reports.
• VerificationResult is not cryptographically attested. Anyone can construct one — including one with a valid-looking binding. The binding hash only detects a mismatch between a result and its response/metadata; it does not authenticate the result itself. Before acting on a result you did not produce in-process, require trusted provenance or cryptographic attestation (tracked in qwed-verification #319).
• Zero guards fail closed. ResponseVerifier.verify() without guards returns verified=False; verify_structured_output() raises ValueError when both a schema and guards are absent — absence of verification is never success.
• Streaming warn-only mode disables the trust boundary. OpenResponsesMiddleware(block_on_failure=False) passes failed items through unmodified — use it for monitoring only.

Why QWED Open Responses?

Links

• Docs: docs.qwedai.com/docs/open-responses
• GitHub: QWED-AI/qwed-open-responses
• PyPI: qwed-open-responses
• QWED Core: QWED-AI/qwed-verification

License

Apache 2.0 - See LICENSE