tappass — Zero Trust Control Plane for Agentic AI (Python SDK)

Runtime governance for your LLM, agent, and tool calls. Embed in your code, get a typed audit trail, surface governance decisions as Python exceptions.

What this SDK is for:

  • Governing LLM calls, agent runs, and tool executions at runtime.
  • Emitting structured audit events with correlation IDs.
  • Handling governance decisions (block, redact, approve, trust-tier, break-glass) as typed exceptions in your code.

What this SDK is NOT for:

  • Policy CRUD, compliance report generation, Verified credential issuance, retention config, break-glass invocation, tool-integrity approval. Those live in the TapPass dashboard — not in your agent code.

Requirements

  • Python ≥ 3.11.
  • tappass server ≥ 0.6.0. (The SDK rejects older servers at construction time.)

Install

pip install tappass

Quickstart — a governed chat call

from tappass import Agent

agent = Agent("https://tappass.example.com", api_key="tp_...")
r = agent.chat("Summarize Q4 revenue")
print(r.content)
print(r.session_id, r.audit_url)   # correlation IDs, deep link to dashboard

Quickstart — govern a CrewAI run

from crewai import Agent, Task, Crew
from tappass.integrations.crewai import guard_crew

crew = Crew(agents=[...], tasks=[...])

with guard_crew(crew, tappass_url="https://tappass.example.com", api_key="tp_...") as session:
    result = session.kickoff()
    print(session.id, session.audit_url)

Telemetry kill-switch

The SDK delivers audit events to your TapPass server asynchronously via a background reporter. To disable that delivery entirely, set either of:

export TAPPASS_DISABLE_TELEMETRY=1
export DO_NOT_TRACK=1     # community convention — consoledonottrack.com

This only suppresses audit-event delivery. It does not disable governance — govern() calls still run, decisions are still enforced, blocks still raise GovernanceBlocked. The distinction is deliberate: governance is the product you're paying for; telemetry is observability of your own usage.

Decisions are typed exceptions

from tappass import GovernanceDecision, PolicyBlockError, ApprovalRequired

try:
    r = agent.chat("Show me all customer SSNs")
except PolicyBlockError as e:
    print(f"Blocked by {e.blocked_by}: {e.reason}. See {e.audit_url}")
except ApprovalRequired as e:
    print(f"Awaiting approval: {e.approval_url}")
except GovernanceDecision as e:
    print(f"Governance decision: {e}")

What's new in 0.6

See CHANGELOG.md. Breaking changes — no back-compat with 0.5.x. See the migration guide.

Publishing a release

Releases ship to PyPI via GitHub Actions using OIDC Trusted Publishing — no long-lived API token is stored anywhere. The workflow is .github/workflows/release.yml.

One-time PyPI configuration

Only needed once per project (or whenever the workflow name / environment changes):

  1. Log in to https://pypi.org/manage/account/publishing/.
  2. Under Add a new pending publisher (if the project isn't on PyPI yet) or the existing project's Publishing tab, add a GitHub publisher with:
    • PyPI Project Name: tappass
    • Owner: tappass
    • Repository name: tappass-sdk
    • Workflow name: release.yml
    • Environment name: pypi
  3. In the GitHub repo, go to Settings → Environments and create an environment named pypi. Optionally add a required-reviewers protection rule so a human approves each release.

That's it — no secrets, no tokens.

Cutting a release

  1. Bump version in pyproject.toml (and __version__ in tappass/__init__.py).
  2. Update CHANGELOG.md: flip ## [X.Y.Z] — Unreleased to ## [X.Y.Z] — YYYY-MM-DD.
  3. Commit: git commit -am "release: X.Y.Z".
  4. Tag and push: 
    git tag vX.Y.Z
git push origin main --tags

The workflow then:

  1. Verifies the tag matches pyproject.toml version (fails the release if not).
  2. Builds wheel + sdist.
  3. Runs twine check.
  4. Publishes to PyPI via OIDC.
  5. Creates a GitHub Release with the wheel + sdist attached and auto-generated notes.

Dry run

To build the artifacts without publishing, use Actions → Release to PyPI → Run workflow with dry_run checked. The publish and github_release jobs are skipped; the build job's artifacts are retained for inspection.

License

Apache-2.0. See LICENSE.

Project links

Data verified by PyPI on Aug 28, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.12.44)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for tappassai from gravatar.com tappassai

Credits

Author: Jens Bontinck

GitHub Statistics

Data verified by PyPI on Aug 28, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.11

Provides Extra

all crewai dev fastapi google-adk langchain openai sandbox temporal

Tags

ai-agents audit capability-tokens crewai eu-ai-act gdpr governance langchain llm openai pii-detection prompt-injection security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

tappass-0.12.34.tar.gz (336.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

tappass-0.12.34-py3-none-any.whl (445.9 kB view details)

Uploaded Python 3

File details

Details for the file tappass-0.12.34.tar.gz.

File metadata

  • Download URL: tappass-0.12.34.tar.gz
  • Upload date:
  • Size: 336.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.34.tar.gz
Algorithm Hash digest
SHA256 82d79332d1d3302815c88befca14498b411d98243d023fc5be5f4e41e734849a
MD5 4cd184d47ffe2cd7b305c2c1afca9679
BLAKE2b-256 3ae2cff30c8df534f9f4729265ec2865e507cf14e446cdf384899a384410a949

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.34.tar.gz:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file tappass-0.12.34-py3-none-any.whl.

File metadata

  • Download URL: tappass-0.12.34-py3-none-any.whl
  • Upload date:
  • Size: 445.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.34-py3-none-any.whl
Algorithm Hash digest
SHA256 6915b4c06787cea4cec07491de47bf9244cdd4b0e8fe116d0659896baf9b2214
MD5 5ea28d88be42c63358137a00aa1f7f5a
BLAKE2b-256 8d1fe0ad126ebbda05baef3ad4897a87d09ba0b33968d5bf18a66be8006c9969

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.34-py3-none-any.whl:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.12.44

2 files

0.12.43

2 files

0.12.42

2 files

0.12.41

2 files

0.12.40

2 files

0.12.39

2 files

0.12.38

2 files

0.12.37

2 files

0.12.36

2 files

0.12.35

2 files

This release

0.12.34 This release

2 files

0.12.33

2 files

0.12.32

2 files

0.12.31

2 files

0.12.30

2 files

0.12.29

2 files

0.12.28

2 files

0.12.27

2 files

0.12.26

2 files

0.12.24

2 files

0.12.23

2 files

0.12.22

2 files

0.12.21

2 files

0.12.20

2 files

0.12.19

2 files

0.12.17

2 files

0.12.16

2 files

0.12.15

2 files

0.12.14

2 files

0.12.13

2 files

0.12.12

2 files

0.12.11

2 files

0.12.10

2 files

0.12.9

2 files

0.12.8

2 files

0.12.7

2 files

0.12.6

2 files

0.12.5

2 files

0.12.4

2 files

0.12.3

2 files

0.12.2

2 files

0.12.1

2 files

0.12.0

2 files

0.11.12

2 files

0.11.11

2 files

0.11.10

2 files

0.11.9

2 files

0.11.8

2 files

0.11.7

2 files

0.11.6

2 files

0.11.5

2 files

0.11.4

2 files

0.11.3

2 files

0.11.2

2 files

0.11.1

2 files

0.11.0

2 files

0.10.1

2 files

0.10.0

2 files

0.9.0

2 files

0.6.2

2 files

0.6.1

2 files

0.6.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page