---
title: "Open Responses"
description: "QWED Open Responses checks agent tool calls and outputs before they run: dangerous tools, arguments, schemas, totals, state changes and PII."
url: https://qwedai.com/platform/open-responses
---

Open Responsesv0.6.1

# Verify agent tool calls before they run.

Guards that sit between an agent and its tools. Each tool call and each output is checked against your rules before anything executes, with no model in the verification path.

[Read the documentation](https://docs.qwedai.com/open-responses/overview) [Source on GitHub](https://github.com/QWED-AI/qwed-open-responses)

At a glance

Version

0.6.1

Status on PyPI

Beta

Install

pip install qwed-open-responses

Works with

OpenAI Responses API, LangChain, LlamaIndex

Also on

npm (qwed-open-responses)

Model in the check

None

Licence

Apache-2.0

## Guards

-   ToolGuard

    ### Dangerous tools

    Blocks named dangerous tools and dangerous patterns in tool calls.

-   ArgumentGuard

    ### Arguments

    Checks argument types and ranges.

-   SchemaGuard

    ### Structured output

    Output must match a JSON Schema.

-   MathGuard

    ### Totals

    Recomputes totals with SymPy.

-   StateGuard

    ### State changes

    Only allowed state transitions pass.

-   SafetyGuard

    ### Safety

    Personal data, prompt injection and budget.

-   FinanceGuard, LegalGuard, TaxGuard

    ### Domain checks

    Wrappers that run QWED Finance, Legal and Tax checks on agent output.

## Mistakes it is built to catch

Nobody checked any of it

### Without Open Responses

-   **A destructive shell call** An agent calls execute\_shell("rm -rf /").

-   **A wrong calculation** An agent returns a total that does not add up.

-   **Malformed output** JSON that breaks the schema the next system expects.

Each one checked before it is used

### With Open Responses

1.  **A destructive shell call** ToolGuard A blocked tool pattern, so the call never runs.

    BLOCKED · DENY
2.  **A wrong calculation** MathGuard The total is recomputed, and the wrong one is held.

    VERIFIED · DENY
3.  **Malformed output** SchemaGuard It does not match the schema, so it is held.

    VERIFIED · DENY

What is proven correct goes through, with a record of why.

QWED returns the decision; your integration acts on it.

## Get started

shell

```
$ pip install qwed-open-responses
```

[Documentation](https://docs.qwedai.com/open-responses/overview) [Repository](https://github.com/QWED-AI/qwed-open-responses) [PyPI](https://pypi.org/project/qwed-open-responses/) [Release history](https://qwedai.com/releases)

Good to know

-   Tool blocking is a configurable blocklist, not a sandbox, and pattern scanning is a heuristic.
-   Personal data produces warnings, not blocks.
-   Results are not cryptographically attested.
-   Warn-only streaming mode turns the trust boundary off.

[**Use case: AI agents** Runtime verification for agents: before an agent runs a tool, messages another agent or makes a purchase, QWED checks the action.](https://qwedai.com/solutions/ai-agents)

## More agents and protocols

-   [MCP server](https://qwedai.com/platform/mcp)
-   [QWED A2A](https://qwedai.com/platform/a2a)
-   [QWED UCP](https://qwedai.com/platform/ucp)
-   [Every package](https://qwedai.com/ecosystem)