Open-source runtime verification for AI, licensed under Apache-2.0.
QWED
Contact

Type to search pages, engines and advisories.

    Looking for API details?Search the docs

    Open Responsesv0.6.1

    Verify agent tool calls before they run.

    Guards that sit between an agent and its tools. Each tool call and each output is checked against your rules before anything executes, with no model in the verification path.

    Read the documentationSource on GitHub

    At a glance

    Version
    0.6.1
    Status on PyPI
    Beta
    Install
    pip install qwed-open-responses
    Works with
    OpenAI Responses API, LangChain, LlamaIndex
    Also on
    npm (qwed-open-responses)
    Model in the check
    None
    Licence
    Apache-2.0

    Guards

    • ToolGuard

      Dangerous tools

      Blocks named dangerous tools and dangerous patterns in tool calls.

    • ArgumentGuard

      Arguments

      Checks argument types and ranges.

    • SchemaGuard

      Structured output

      Output must match a JSON Schema.

    • MathGuard

      Totals

      Recomputes totals with SymPy.

    • StateGuard

      State changes

      Only allowed state transitions pass.

    • SafetyGuard

      Safety

      Personal data, prompt injection and budget.

    • FinanceGuard, LegalGuard, TaxGuard

      Domain checks

      Wrappers that run QWED Finance, Legal and Tax checks on agent output.

    Mistakes it is built to catch

    Nobody checked any of it

    Without Open Responses

    • A destructive shell callAn agent calls execute_shell("rm -rf /").
    • A wrong calculationAn agent returns a total that does not add up.
    • Malformed outputJSON that breaks the schema the next system expects.

    Each one checked before it is used

    With Open Responses

    1. A destructive shell callToolGuardA blocked tool pattern, so the call never runs.
      BLOCKED · DENY
    2. A wrong calculationMathGuardThe total is recomputed, and the wrong one is held.
      VERIFIED · DENY
    3. Malformed outputSchemaGuardIt does not match the schema, so it is held.
      VERIFIED · DENY

    What is proven correct goes through, with a record of why.

    QWED returns the decision; your integration acts on it.

    Get started

    shell
    pip install qwed-open-responses
    DocumentationRepository PyPI Release history

    Good to know

    • Tool blocking is a configurable blocklist, not a sandbox, and pattern scanning is a heuristic.
    • Personal data produces warnings, not blocks.
    • Results are not cryptographically attested.
    • Warn-only streaming mode turns the trust boundary off.
    Use case: AI agentsRuntime verification for agents: before an agent runs a tool, messages another agent or makes a purchase, QWED checks the action.

    More agents and protocols