tappass — Zero Trust Control Plane for Agentic AI (Python SDK)

Runtime governance for your LLM, agent, and tool calls. Embed in your code, get a typed audit trail, surface governance decisions as Python exceptions.

What this SDK is for:

  • Governing LLM calls, agent runs, and tool executions at runtime.
  • Emitting structured audit events with correlation IDs.
  • Handling governance decisions (block, redact, approve, trust-tier, break-glass) as typed exceptions in your code.

What this SDK is NOT for:

  • Policy CRUD, compliance report generation, Verified credential issuance, retention config, break-glass invocation, tool-integrity approval. Those live in the TapPass dashboard — not in your agent code.

Requirements

  • Python ≥ 3.11.
  • tappass server ≥ 0.6.0. (The SDK rejects older servers at construction time.)

Install

pip install tappass

Quickstart — a governed chat call

from tappass import Agent

agent = Agent("https://tappass.example.com", api_key="tp_...")
r = agent.chat("Summarize Q4 revenue")
print(r.content)
print(r.session_id, r.audit_url)   # correlation IDs, deep link to dashboard

Quickstart — govern a CrewAI run

from crewai import Agent, Task, Crew
from tappass.integrations.crewai import guard_crew

crew = Crew(agents=[...], tasks=[...])

with guard_crew(crew, tappass_url="https://tappass.example.com", api_key="tp_...") as session:
    result = session.kickoff()
    print(session.id, session.audit_url)

Telemetry kill-switch

The SDK delivers audit events to your TapPass server asynchronously via a background reporter. To disable that delivery entirely, set either of:

export TAPPASS_DISABLE_TELEMETRY=1
export DO_NOT_TRACK=1     # community convention — consoledonottrack.com

This only suppresses audit-event delivery. It does not disable governance — govern() calls still run, decisions are still enforced, blocks still raise GovernanceBlocked. The distinction is deliberate: governance is the product you're paying for; telemetry is observability of your own usage.

Decisions are typed exceptions

from tappass import GovernanceDecision, PolicyBlockError, ApprovalRequired

try:
    r = agent.chat("Show me all customer SSNs")
except PolicyBlockError as e:
    print(f"Blocked by {e.blocked_by}: {e.reason}. See {e.audit_url}")
except ApprovalRequired as e:
    print(f"Awaiting approval: {e.approval_url}")
except GovernanceDecision as e:
    print(f"Governance decision: {e}")

What's new in 0.6

See CHANGELOG.md. Breaking changes — no back-compat with 0.5.x. See the migration guide.

Publishing a release

Releases ship to PyPI via GitHub Actions using OIDC Trusted Publishing — no long-lived API token is stored anywhere. The workflow is .github/workflows/release.yml.

One-time PyPI configuration

Only needed once per project (or whenever the workflow name / environment changes):

  1. Log in to https://pypi.org/manage/account/publishing/.
  2. Under Add a new pending publisher (if the project isn't on PyPI yet) or the existing project's Publishing tab, add a GitHub publisher with:
    • PyPI Project Name: tappass
    • Owner: tappass
    • Repository name: tappass-sdk
    • Workflow name: release.yml
    • Environment name: pypi
  3. In the GitHub repo, go to Settings → Environments and create an environment named pypi. Optionally add a required-reviewers protection rule so a human approves each release.

That's it — no secrets, no tokens.

Cutting a release

  1. Bump version in pyproject.toml (and __version__ in tappass/__init__.py).
  2. Update CHANGELOG.md: flip ## [X.Y.Z] — Unreleased to ## [X.Y.Z] — YYYY-MM-DD.
  3. Commit: git commit -am "release: X.Y.Z".
  4. Tag and push: 
    git tag vX.Y.Z
git push origin main --tags

The workflow then:

  1. Verifies the tag matches pyproject.toml version (fails the release if not).
  2. Builds wheel + sdist.
  3. Runs twine check.
  4. Publishes to PyPI via OIDC.
  5. Creates a GitHub Release with the wheel + sdist attached and auto-generated notes.

Dry run

To build the artifacts without publishing, use Actions → Release to PyPI → Run workflow with dry_run checked. The publish and github_release jobs are skipped; the build job's artifacts are retained for inspection.

License

Apache-2.0. See LICENSE.

Project links

Data verified by PyPI on Aug 30, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.12.44)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for tappassai from gravatar.com tappassai

Credits

Author: Jens Bontinck

GitHub Statistics

Data verified by PyPI on Aug 30, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.11

Provides Extra

all crewai dev fastapi google-adk langchain openai sandbox temporal

Tags

ai-agents audit capability-tokens crewai eu-ai-act gdpr governance langchain llm openai pii-detection prompt-injection security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

tappass-0.12.37.tar.gz (339.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

tappass-0.12.37-py3-none-any.whl (449.1 kB view details)

Uploaded Python 3

File details

Details for the file tappass-0.12.37.tar.gz.

File metadata

  • Download URL: tappass-0.12.37.tar.gz
  • Upload date:
  • Size: 339.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.37.tar.gz
Algorithm Hash digest
SHA256 ee60bcb4842b2c066ae00b34ac49dbb809fec1ab20134c1248201a28f2e5c204
MD5 47ad8a802526cd16278629806af0fe48
BLAKE2b-256 85963e636e5fe076ad45cbf73e5b2caff5fd067d92bc404747aafebdb4327e49

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.37.tar.gz:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file tappass-0.12.37-py3-none-any.whl.

File metadata

  • Download URL: tappass-0.12.37-py3-none-any.whl
  • Upload date:
  • Size: 449.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.37-py3-none-any.whl
Algorithm Hash digest
SHA256 8346b4dbf4b6a61f0e2f10fca195a46cd82dac1737d30e0adea9e33fac1b8618
MD5 84fb98617f0160ee71fff5a952170da7
BLAKE2b-256 6c0e0919a856e17a0f7ea4818b1c37668684c9d05716edd72a5cb52a3ea50cbc

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.37-py3-none-any.whl:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.12.44

2 files

0.12.43

2 files

0.12.42

2 files

0.12.41

2 files

0.12.40

2 files

0.12.39

2 files

0.12.38

2 files

This release

0.12.37 This release

2 files

0.12.36

2 files

0.12.35

2 files

0.12.34

2 files

0.12.33

2 files

0.12.32

2 files

0.12.31

2 files

0.12.30

2 files

0.12.29

2 files

0.12.28

2 files

0.12.27

2 files

0.12.26

2 files

0.12.24

2 files

0.12.23

2 files

0.12.22

2 files

0.12.21

2 files

0.12.20

2 files

0.12.19

2 files

0.12.17

2 files

0.12.16

2 files

0.12.15

2 files

0.12.14

2 files

0.12.13

2 files

0.12.12

2 files

0.12.11

2 files

0.12.10

2 files

0.12.9

2 files

0.12.8

2 files

0.12.7

2 files

0.12.6

2 files

0.12.5

2 files

0.12.4

2 files

0.12.3

2 files

0.12.2

2 files

0.12.1

2 files

0.12.0

2 files

0.11.12

2 files

0.11.11

2 files

0.11.10

2 files

0.11.9

2 files

0.11.8

2 files

0.11.7

2 files

0.11.6

2 files

0.11.5

2 files

0.11.4

2 files

0.11.3

2 files

0.11.2

2 files

0.11.1

2 files

0.11.0

2 files

0.10.1

2 files

0.10.0

2 files

0.9.0

2 files

0.6.2

2 files

0.6.1

2 files

0.6.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page