tappass — Zero Trust Control Plane for Agentic AI (Python SDK)

Runtime governance for your LLM, agent, and tool calls. Embed in your code, get a typed audit trail, surface governance decisions as Python exceptions.

What this SDK is for:

  • Governing LLM calls, agent runs, and tool executions at runtime.
  • Emitting structured audit events with correlation IDs.
  • Handling governance decisions (block, redact, approve, trust-tier, break-glass) as typed exceptions in your code.

What this SDK is NOT for:

  • Policy CRUD, compliance report generation, Verified credential issuance, retention config, break-glass invocation, tool-integrity approval. Those live in the TapPass dashboard — not in your agent code.

Requirements

  • Python ≥ 3.11.
  • tappass server ≥ 0.6.0. (The SDK rejects older servers at construction time.)

Install

pip install tappass

Quickstart — a governed chat call

from tappass import Agent

agent = Agent("https://tappass.example.com", api_key="tp_...")
r = agent.chat("Summarize Q4 revenue")
print(r.content)
print(r.session_id, r.audit_url)   # correlation IDs, deep link to dashboard

Quickstart — govern a CrewAI run

from crewai import Agent, Task, Crew
from tappass.integrations.crewai import guard_crew

crew = Crew(agents=[...], tasks=[...])

with guard_crew(crew, tappass_url="https://tappass.example.com", api_key="tp_...") as session:
    result = session.kickoff()
    print(session.id, session.audit_url)

Telemetry kill-switch

The SDK delivers audit events to your TapPass server asynchronously via a background reporter. To disable that delivery entirely, set either of:

export TAPPASS_DISABLE_TELEMETRY=1
export DO_NOT_TRACK=1     # community convention — consoledonottrack.com

This only suppresses audit-event delivery. It does not disable governance — govern() calls still run, decisions are still enforced, blocks still raise GovernanceBlocked. The distinction is deliberate: governance is the product you're paying for; telemetry is observability of your own usage.

Decisions are typed exceptions

from tappass import GovernanceDecision, PolicyBlockError, ApprovalRequired

try:
    r = agent.chat("Show me all customer SSNs")
except PolicyBlockError as e:
    print(f"Blocked by {e.blocked_by}: {e.reason}. See {e.audit_url}")
except ApprovalRequired as e:
    print(f"Awaiting approval: {e.approval_url}")
except GovernanceDecision as e:
    print(f"Governance decision: {e}")

What's new in 0.6

See CHANGELOG.md. Breaking changes — no back-compat with 0.5.x. See the migration guide.

Publishing a release

Releases ship to PyPI via GitHub Actions using OIDC Trusted Publishing — no long-lived API token is stored anywhere. The workflow is .github/workflows/release.yml.

One-time PyPI configuration

Only needed once per project (or whenever the workflow name / environment changes):

  1. Log in to https://pypi.org/manage/account/publishing/.
  2. Under Add a new pending publisher (if the project isn't on PyPI yet) or the existing project's Publishing tab, add a GitHub publisher with:
    • PyPI Project Name: tappass
    • Owner: tappass
    • Repository name: tappass-sdk
    • Workflow name: release.yml
    • Environment name: pypi
  3. In the GitHub repo, go to Settings → Environments and create an environment named pypi. Optionally add a required-reviewers protection rule so a human approves each release.

That's it — no secrets, no tokens.

Cutting a release

  1. Bump version in pyproject.toml (and __version__ in tappass/__init__.py).
  2. Update CHANGELOG.md: flip ## [X.Y.Z] — Unreleased to ## [X.Y.Z] — YYYY-MM-DD.
  3. Commit: git commit -am "release: X.Y.Z".
  4. Tag and push: 
    git tag vX.Y.Z
git push origin main --tags

The workflow then:

  1. Verifies the tag matches pyproject.toml version (fails the release if not).
  2. Builds wheel + sdist.
  3. Runs twine check.
  4. Publishes to PyPI via OIDC.
  5. Creates a GitHub Release with the wheel + sdist attached and auto-generated notes.

Dry run

To build the artifacts without publishing, use Actions → Release to PyPI → Run workflow with dry_run checked. The publish and github_release jobs are skipped; the build job's artifacts are retained for inspection.

License

Apache-2.0. See LICENSE.

Project links

Data verified by PyPI on Aug 30, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.12.44)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for tappassai from gravatar.com tappassai

Credits

Author: Jens Bontinck

GitHub Statistics

Data verified by PyPI on Aug 30, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.11

Provides Extra

all crewai dev fastapi google-adk langchain openai sandbox temporal

Tags

ai-agents audit capability-tokens crewai eu-ai-act gdpr governance langchain llm openai pii-detection prompt-injection security

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

tappass-0.12.38.tar.gz (339.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

tappass-0.12.38-py3-none-any.whl (449.1 kB view details)

Uploaded Python 3

File details

Details for the file tappass-0.12.38.tar.gz.

File metadata

  • Download URL: tappass-0.12.38.tar.gz
  • Upload date:
  • Size: 339.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.38.tar.gz
Algorithm Hash digest
SHA256 41d95a7ae08ca218fd20befbec0b2a0de599697f444fc284119ad61d1a35afd8
MD5 2d9cc5ce007e0c550b2562e1d7d62c17
BLAKE2b-256 253767ab3d5e9c13de48a98c794594959575f482ebf4053308bf60b0dbeff5d4

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.38.tar.gz:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file tappass-0.12.38-py3-none-any.whl.

File metadata

  • Download URL: tappass-0.12.38-py3-none-any.whl
  • Upload date:
  • Size: 449.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for tappass-0.12.38-py3-none-any.whl
Algorithm Hash digest
SHA256 304e8c0112debecf113f5b7fe0fbf16cd2c170bd22ad825de4af3e4e0633e3bc
MD5 28d4c6290cd2f05a7d427d248f7b9ed8
BLAKE2b-256 41d572e066877a5e608c78a7087f62ab579caabbd474aff6f9fe84b7f721c7e2

See more details on using hashes here.

Provenance

The following attestation bundles were made for tappass-0.12.38-py3-none-any.whl:

Publisher: release.yml on tappass/tappass-sdk

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.12.44

2 files

0.12.43

2 files

0.12.42

2 files

0.12.41

2 files

0.12.40

2 files

0.12.39

2 files

This release

0.12.38 This release

2 files

0.12.37

2 files

0.12.36

2 files

0.12.35

2 files

0.12.34

2 files

0.12.33

2 files

0.12.32

2 files

0.12.31

2 files

0.12.30

2 files

0.12.29

2 files

0.12.28

2 files

0.12.27

2 files

0.12.26

2 files

0.12.24

2 files

0.12.23

2 files

0.12.22

2 files

0.12.21

2 files

0.12.20

2 files

0.12.19

2 files

0.12.17

2 files

0.12.16

2 files

0.12.15

2 files

0.12.14

2 files

0.12.13

2 files

0.12.12

2 files

0.12.11

2 files

0.12.10

2 files

0.12.9

2 files

0.12.8

2 files

0.12.7

2 files

0.12.6

2 files

0.12.5

2 files

0.12.4

2 files

0.12.3

2 files

0.12.2

2 files

0.12.1

2 files

0.12.0

2 files

0.11.12

2 files

0.11.11

2 files

0.11.10

2 files

0.11.9

2 files

0.11.8

2 files

0.11.7

2 files

0.11.6

2 files

0.11.5

2 files

0.11.4

2 files

0.11.3

2 files

0.11.2

2 files

0.11.1

2 files

0.11.0

2 files

0.10.1

2 files

0.10.0

2 files

0.9.0

2 files

0.6.2

2 files

0.6.1

2 files

0.6.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page