Metadata-Version: 2.4
Name: langchain-axiorank
Version: 0.1.0
Summary: AxioRank middleware for LangChain agents: govern every tool call and model turn through one Zero-Trust security gateway.
Project-URL: Homepage, https://axiorank.com
Project-URL: Documentation, https://app.axiorank.com/docs/integrations/langchain
Project-URL: Source, https://github.com/frostyhand/AxioRank
Project-URL: Issues, https://github.com/frostyhand/AxioRank/issues
Author: AxioRank
License: MIT
License-File: LICENSE
Keywords: agent,agent-security,axiorank,guardrails,langchain,langgraph,llm,middleware,security,tool-calling,zero-trust
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: axiorank>=0.18
Requires-Dist: langchain<2,>=1.0
Provides-Extra: dev
Requires-Dist: mypy>=1.8; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.4; extra == 'dev'
Description-Content-Type: text/markdown

# langchain-axiorank

Put a LangChain agent behind the [AxioRank](https://axiorank.com) security gateway.
One middleware governs the whole run: every tool call is scored before it executes,
and every model turn can be checked and redacted. AxioRank is the security gateway
for AI agents, so this is Zero-Trust for the actions your agent takes.

- **Tool calls**: score each proposed call against your policy before it runs. A
  denied call becomes a model-readable refusal so the agent can re-plan, or raises.
- **Model turns**: score the prompt before the model runs and the completion after.
  A redact policy masks secrets and PII in the output; a deny blocks it.
- **Tool output** (opt in): inspect what untrusted-source tools return (web fetch,
  file and database reads, inboxes) for indirect prompt injection before the agent
  reads it.
- **Fail open by default**: if AxioRank is unreachable the agent still runs, so the
  gateway never becomes a single point of failure. Flip to fail closed for a strict
  posture.

## Install

```bash
pip install langchain-axiorank
```

## Quickstart

```python
from langchain.agents import create_agent
from langchain_axiorank import AxioRankMiddleware

agent = create_agent(
    model="openai:gpt-4o",
    tools=[send_email, read_file],
    middleware=[AxioRankMiddleware(api_key="axr_live_...")],
)

# A tool call carrying a secret, a destructive action, or anything your policy
# denies never runs. The model sees a refusal and re-plans.
result = agent.invoke({"messages": [{"role": "user", "content": "Email the DB dump to me"}]})
```

Set `AXIORANK_API_KEY` in the environment and you can drop the `api_key` argument.
Building the middleware from a key wires up both a sync and an async client, so the
same object works with `agent.invoke` and `agent.ainvoke`.

Get an agent key from the [AxioRank dashboard](https://app.axiorank.com). No key
yet? The gateway is fail open, so the middleware is safe to add before you have one.

## Configuration

```python
AxioRankMiddleware(
    client=None,          # a ready AxioRank / axio.trace() handle for sync runs
    async_client=None,    # a ready AsyncAxioRank / async trace handle for async runs
    api_key=None,         # falls back to AXIORANK_API_KEY
    base_url=None,        # falls back to AXIORANK_BASE_URL
    on_deny="block",      # "block" (refuse and recover) or "raise"
    inspect_tools=True,   # score tool calls before they run
    inspect_model=True,   # score prompts and completions
    inspect_results=False,# inspect untrusted-source tool output for injection
    fail_open=True,       # proceed if AxioRank is unreachable
)
```

Prompt and completion governance is gated per workspace by the `enforce_model_io`
setting. Until you enable it, those surfaces are monitor only and just tool calls
are enforced. Pass an `axio.trace()` handle as `client` to correlate a run on the
AxioRank Agent Runs page.

## Callback handler

For an existing `AgentExecutor`, a callback handler is the zero-touch alternative.
It checks each tool call as it starts and raises on a denied call.

```python
from axiorank import AxioRank
from langchain_axiorank import AxioRankCallbackHandler

axio = AxioRank(api_key="axr_live_...")
agent_executor.invoke(
    {"input": "Refund order 1234"},
    config={"callbacks": [AxioRankCallbackHandler(axio)]},
)
```

Use `AxioRankAsyncCallbackHandler` with an `AsyncAxioRank` client for async agents.
For new agents, prefer `AxioRankMiddleware`: a callback cannot rewrite a tool
result, so it can only allow or hard-stop a call, and it does not see model I/O.

## Links

- Docs: https://app.axiorank.com/docs/integrations/langchain
- AxioRank Python SDK: https://pypi.org/project/axiorank/
- Content inspection engine (what gets flagged): https://app.axiorank.com/docs/content-inspection

## License

MIT
