Python apps

Add one line, and every model call and tool call in your app is checked and shows on the agent's Activity tab.

Before you start

If you ran agentfox init or agentfox up and answered Y, the line is already there. Skip to step 2.

Add the line
Put it at startup, before any code that calls a model.
main.py
```
import agentfox

agentfox.auto(agent="support-triage", mode="observe")
```
agent is the name everything is recorded under. Set it, so renaming a file does not make a new agent.
Run your app
Run it from the folder where init ran, or set the two environment variables. At startup it prints what it patched; with a key it adds "Every check goes to your AgentFox account". Each call then shows up with the checks it went through.
Look at the issues, then block
In watch mode nothing is stopped. When the Issues page shows only what you want stopped, remove mode="observe". The default mode lets your rules decide: a rule in Block stops the call.

Where auto() finds the account key

It takes the first of these it finds:

agentfox.auto(server="https://…", key="nom_api_…")
AGENTFOX_URL and AGENTFOX_API_KEY in the environment
.agentfox/agentfox.env in the working directory, which agentfox init --key writes

With none, the checks run in your process and are kept on this machine. In production, set the two variables:

bash

export AGENTFOX_URL=https://…
export AGENTFOX_API_KEY=nom_api_…

Observe or enforce

`mode`	What it stops
`"observe"`	Nothing. What would have been stopped is recorded. Use it first.
`"policy"` (default)	What your rules in Block stop, a stopped agent, and a budget cap. Use it in production.
`"enforce"`	Anything a rule would stop, even one still in Watch. Use it in tests and CI.

A stopped call raises agentfox.Blocked. A refused LangChain tool hands the agent the refusal as the tool's result instead, and the run carries on.

What it covers

Patched: openai chat completions and the Responses API, anthropic messages, litellm, LangChain chat models and tools, and CrewAI tools. Sync, async and streamed.
LangChain, LangGraph, CrewAI, LlamaIndex, AutoGen, the OpenAI Agents SDK: covered through the client they call the model with. LangChain and CrewAI tools are also checked where they run, so a CrewAI agent's text tool calls ("Action: ...") are checked too. For checks on graph nodes, see LangGraph.
Not covered: a tool your code calls without the model asking (LangChain and CrewAI tools excepted), and other processes. Tools OpenAI hosts (web search, file search, code interpreter) are recorded, not stopped: they ran before the response came back.

OpenAI Agents SDK

The Agents SDK calls the model through the Responses API, which auto() patches: every model call, each tool call the model asks for (before the SDK runs it) and each tool result fed back are checked, with nothing else added. A refused tool call raises agentfox.Blocked out of Runner.run. If you would rather the refusal went back to the model as the tool's answer, so the run carries on, use govern() instead, once, after you build your agents (pip install "agentfox[openai-agents]"):

python

import os
from agentfox.frameworks.sdk import AgentFox
from agentfox.frameworks.openai_agents import govern

fox = AgentFox("support-bot", base_url=os.environ["AGENTFOX_URL"],
               api_key=os.environ["AGENTFOX_API_KEY"])
govern(fox, triage_agent)  # its hand-offs and tools too

If something goes wrong

You see	Do this
Nothing patched	None of the libraries above is installed in this Python. Check the virtual environment.
Nothing on Activity	`auto()` ran after the first model call, or no key was found.
Every tool call is refused in enforce mode	Give the agent its tools (Tool access), or use the default mode.

Before you start

If you ran agentfox init or agentfox up and answered Y, the line is already there. Skip to step 2.

Add the line

Put it at startup, before any code that calls a model.

main.py

import agentfox

agentfox.auto(agent="support-triage", mode="observe")

agent is the name everything is recorded under. Set it, so renaming a file does not make a new agent.

Run your app

Run it from the folder where init ran, or set the two environment variables. At startup it prints what it patched; with a key it adds "Every check goes to your AgentFox account". Each call then shows up with the checks it went through.

An agent's Activity tab listing runs recorded from the app, each with its checks and verdict.

Look at the issues, then block

In watch mode nothing is stopped. When the Issues page shows only what you want stopped, remove mode="observe". The default mode lets your rules decide: a rule in Block stops the call.

Where auto() finds the account key

It takes the first of these it finds:

agentfox.auto(server="https://…", key="nom_api_…")

AGENTFOX_URL and AGENTFOX_API_KEY in the environment

.agentfox/agentfox.env in the working directory, which agentfox init --key writes

With none, the checks run in your process and are kept on this machine. In production, set the two variables:

bash

export AGENTFOX_URL=https://…
export AGENTFOX_API_KEY=nom_api_…

Observe or enforce

mode

What it stops

"observe"

Nothing. What would have been stopped is recorded. Use it first.

"policy" (default)

What your rules in Block stop, a stopped agent, and a budget cap. Use it in production.

"enforce"

Anything a rule would stop, even one still in Watch. Use it in tests and CI.

A stopped call raises agentfox.Blocked. A refused LangChain tool hands the agent the refusal as the tool's result instead, and the run carries on.

What it covers

Patched: openai chat completions and the Responses API, anthropic messages, litellm, LangChain chat models and tools, and CrewAI tools. Sync, async and streamed.

LangChain, LangGraph, CrewAI, LlamaIndex, AutoGen, the OpenAI Agents SDK: covered through the client they call the model with. LangChain and CrewAI tools are also checked where they run, so a CrewAI agent's text tool calls ("Action: ...") are checked too. For checks on graph nodes, see LangGraph.

Not covered: a tool your code calls without the model asking (LangChain and CrewAI tools excepted), and other processes. Tools OpenAI hosts (web search, file search, code interpreter) are recorded, not stopped: they ran before the response came back.

If something goes wrong

You see

Do this

Nothing patched

None of the libraries above is installed in this Python. Check the virtual environment.

Nothing on Activity

auto() ran after the first model call, or no key was found.

Every tool call is refused in enforce mode

Give the agent its tools (Tool access), or use the default mode.