tappass — Zero Trust Control Plane for Agentic AI (Python SDK)

Runtime governance for your LLM, agent, and tool calls. Embed in your code, get a typed audit trail, surface governance decisions as Python exceptions.

What this SDK is for:

  • Governing LLM calls, agent runs, and tool executions at runtime.
  • Emitting structured audit events with correlation IDs.
  • Handling governance decisions (block, redact, approve, trust-tier, break-glass) as typed exceptions in your code.

What this SDK is NOT for:

  • Policy CRUD, compliance report generation, Verified credential issuance, retention config, break-glass invocation, tool-integrity approval. Those live in the TapPass dashboard — not in your agent code.

Requirements

  • Python ≥ 3.11.
  • tappass server ≥ 0.6.0. (The SDK rejects older servers at construction time.)

Install

pip install tappass

Quickstart — a governed chat call

from tappass import Agent

agent = Agent("https://tappass.example.com", api_key="tp_...")
r = agent.chat("Summarize Q4 revenue")
print(r.content)
print(r.session_id, r.audit_url)   # correlation IDs, deep link to dashboard

Quickstart — govern a CrewAI run

from crewai import Agent, Task, Crew
from tappass.integrations.crewai import guard_crew

crew = Crew(agents=[...], tasks=[...])

with guard_crew(crew, tappass_url="https://tappass.example.com", api_key="tp_...") as session:
    result = session.kickoff()
    print(session.id, session.audit_url)

Telemetry kill-switch

The SDK delivers audit events to your TapPass server asynchronously via a background reporter. To disable that delivery entirely, set either of:

export TAPPASS_DISABLE_TELEMETRY=1
export DO_NOT_TRACK=1     # community convention — consoledonottrack.com

This only suppresses audit-event delivery. It does not disable governance — govern() calls still run, decisions are still enforced, blocks still raise GovernanceBlocked. The distinction is deliberate: governance is the product you're paying for; telemetry is observability of your own usage.

Decisions are typed exceptions

from tappass import GovernanceDecision, PolicyBlockError, ApprovalRequired

try:
    r = agent.chat("Show me all customer SSNs")
except PolicyBlockError as e:
    print(f"Blocked by {e.blocked_by}: {e.reason}. See {e.audit_url}")
except ApprovalRequired as e:
    print(f"Awaiting approval: {e.approval_url}")
except GovernanceDecision as e:
    print(f"Governance decision: {e}")

What's new in 0.6

See CHANGELOG.md. Breaking changes — no back-compat with 0.5.x. See the migration guide.

Publishing a release

Releases ship to PyPI via GitHub Actions using OIDC Trusted Publishing — no long-lived API token is stored anywhere. The workflow is .github/workflows/release.yml.

One-time PyPI configuration

Only needed once per project (or whenever the workflow name / environment changes):

  1. Log in to https://pypi.org/manage/account/publishing/.
  2. Under Add a new pending publisher (if the project isn't on PyPI yet) or the existing project's Publishing tab, add a GitHub publisher with:
    • PyPI Project Name: tappass
    • Owner: tappass
    • Repository name: tappass-sdk
    • Workflow name: release.yml
    • Environment name: pypi
  3. In the GitHub repo, go to Settings → Environments and create an environment named pypi. Optionally add a required-reviewers protection rule so a human approves each release.

That's it — no secrets, no tokens.

Cutting a release

  1. Bump version in pyproject.toml (and __version__ in tappass/__init__.py).
  2. Update CHANGELOG.md: flip ## [X.Y.Z] — Unreleased to ## [X.Y.Z] — YYYY-MM-DD.
  3. Commit: git commit -am "release: X.Y.Z".
  4. Tag and push: 
    git tag vX.Y.Z
git push origin main --tags

The workflow then:

  1. Verifies the tag matches pyproject.toml version (fails the release if not).
  2. Builds wheel + sdist.
  3. Runs twine check.
  4. Publishes to PyPI via OIDC.
  5. Creates a GitHub Release with the wheel + sdist attached and auto-generated notes.

Dry run

To build the artifacts without publishing, use Actions → Release to PyPI → Run workflow with dry_run checked. The publish and github_release jobs are skipped; the build job's artifacts are retained for inspection.

License

Apache-2.0. See LICENSE.

Project links

Data verified by PyPI on Aug 22, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.12.20)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for tappassai from gravatar.com tappassai

Credits

Author: Jens Bontinck

GitHub Statistics

Data verified by PyPI on Aug 22, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.11

Provides Extra

all crewai dev fastapi google-adk langchain openai sandbox temporal

Tags

ai-agents audit capability-tokens crewai eu-ai-act gdpr governance langchain llm openai pii-detection prompt-injection security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

tappass-0.12.19.tar.gz (322.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

tappass-0.12.19-py3-none-any.whl (429.4 kB view details)

Uploaded Python 3

File details

Details for the file tappass-0.12.19.tar.gz.

File metadata

  • Download URL: tappass-0.12.19.tar.gz
  • Upload date:
  • Size: 322.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.19.tar.gz
Algorithm Hash digest
SHA256 bd6e6a60f35580a42c2fbe7aaad4c4f5c28c7134a702d3c27fd54f5a2c0fa884
MD5 5596d4229f17b2e96b798f13e28506ba
BLAKE2b-256 9e015728d41c8453ebdc99b9e58d6de1a9ec3da9f09a67c6dab3c03731ba61c2

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.19.tar.gz:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file tappass-0.12.19-py3-none-any.whl.

File metadata

  • Download URL: tappass-0.12.19-py3-none-any.whl
  • Upload date:
  • Size: 429.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.19-py3-none-any.whl
Algorithm Hash digest
SHA256 3286931ef4161159f6bf1eeac4d6eefe9766ed537d30e889968aa7e3307c48c4
MD5 4140df550387c46df776b51142715bc8
BLAKE2b-256 d845ce1b3c3871892559b0f68dd70d8d25411fd22de9f18a37553acacd8048a2

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.19-py3-none-any.whl:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.12.20

2 files

This release

0.12.19 This release

2 files

0.12.17

2 files

0.12.16

2 files

0.12.15

2 files

0.12.14

2 files

0.12.13

2 files

0.12.12

2 files

0.12.11

2 files

0.12.10

2 files

0.12.9

2 files

0.12.8

2 files

0.12.7

2 files

0.12.6

2 files

0.12.5

2 files

0.12.4

2 files

0.12.3

2 files

0.12.2

2 files

0.12.1

2 files

0.12.0

2 files

0.11.12

2 files

0.11.11

2 files

0.11.10

2 files

0.11.9

2 files

0.11.8

2 files

0.11.7

2 files

0.11.6

2 files

0.11.5

2 files

0.11.4

2 files

0.11.3

2 files

0.11.2

2 files

0.11.1

2 files

0.11.0

2 files

0.10.1

2 files

0.10.0

2 files

0.9.0

2 files

0.6.2

2 files

0.6.1

2 files

0.6.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page