Runtime verification for agent actions, before they run.
Agents call tools, talk to other agents and spend money. QWED adds a check at each of those points: tool calls before they run, messages between agents, and checkout totals before payment.
What QWED checks here
- Tool calls
- Agent outputs
- Messages between agents
- Checkout and payment
With Open Responses, QWED A2A, QWED UCP and MCP server
Agents act at machine speed. So do their mistakes.
An agent that is wrong does not pause to ask. It acts.
Nobody checked any of it
Without QWED
-
A destructive tool callAn agent calls a shell tool with rm -rf /.
-
A total that does not add upOne agent tells another that items worth 150.00 come to 999.99.
-
Tax applied wrong at checkoutTax of 8.25% on $100 is charged as $8.00 just before payment goes through.
Each one checked before it is used
With QWED
- A destructive tool callOpen ResponsesA blocked tool pattern, so the call never runs.BLOCKED · DENY
- A total that does not add upQWED A2AThe items come to 150.00, so the message is held.VERIFIED · DENY
- Tax applied wrong at checkoutQWED UCP8.25% of $100 is $8.25, so payment is held.VERIFIED · DENY
What is proven correct goes through, with a record of why.
QWED returns the decision; your integration acts on it.
What QWED checks
Four packages cover the places where an agent acts. None of them asks a model to judge the result.
- Open Responses
Tool calls
ToolGuard blocks dangerous tools and patterns, ArgumentGuard checks argument types and ranges, and SafetyGuard flags personal data, prompt injection and budget.
- Open Responses
Agent outputs
MathGuard recomputes totals, SchemaGuard checks JSON against a schema, and StateGuard enforces allowed state changes.
- A2A
Messages between agents
A trust boundary with allowlists and rate limits, exact checks on money totals, and a signed attestation on every decided result.
- UCP
Checkout and payment
Total must equal subtotal minus discount plus fulfilment, tax and fees, and the checkout must move through valid states.
- MCP server
Exact answers in MCP clients
Lets Claude Desktop, VS Code and other MCP clients run Python calculations in a restricted subprocess instead of guessing.
Where it fits
- Your AI
Decides to call a tool, send a message or complete a purchase.
- QWED
Checks the call, the message or the totals against your rules.
- Your systems
Only checked actions reach your tools, other agents and payment systems.
Good to know
- Open Responses blocks tools from a list you configure. It is not a sandbox, and its pattern scanning is a heuristic.
- In QWED A2A, only finance checks can return verified; logic and code checks alone are not enough to act on.
- The MCP server runs code with the server’s privileges, so connect only clients you trust.
Get started
Guards for agent tool calls and outputs. Works with the OpenAI Responses API, LangChain and LlamaIndex.
pip install qwed-open-responsesA zero-trust interceptor for messages between agents, using the Agent-to-Agent protocol.
pip install qwed-a2aChecks for Universal Commerce Protocol checkouts before the money moves.
pip install qwed-ucpVerification tools for Claude Desktop, VS Code and other MCP clients.
pip install qwed-mcp