Integrations

AgentGuard Spend ships drop-in integrations for LangChain (BaseCallbackHandler), CrewAI (guard_crew), LlamaIndex (guard_llm), Hermes (entry-point auto-discovery), OpenClaw, and Vercel AI SDK. Production storage adapters: Redis (INCRBY + Streams), Postgres (UPSERT + JSONB). Enterprise key management: AWS KMS and HashiCorp Vault Transit. Private keys never leave the HSM.

Agent Frameworks

LangChain (Python)

pip install "agentguard-spend[langchain]"

Callback handler that intercepts before on_chat_model_start and on_llm_start. Raises AgentGuardBlockedError if cap exceeded.

code →

LangChain.js

npm install @agentguard-run/spend @langchain/core

Same callback-handler pattern for Node. Works with ChatOpenAI, ChatAnthropic, any LangChain LLM.

code →

CrewAI

pip install "agentguard-spend[crewai]"

guard_crew() wraps every agent's LLM, splits cap evenly. guard_agent() for per-agent control.

code →

LlamaIndex

pip install "agentguard-spend[llamaindex]"

Wraps the underlying provider client of any LlamaIndex LLM. Every .complete() / .chat() call goes through AgentGuard.

code →

Hermes Agent (Nous Research)

uv pip install agentguard-spend-hermes

Auto-discovered via hermes_agent.plugins entry-point. Monkey-patches Anthropic + OpenAI client constructors. Zero code changes.

code →

Hermes Kanban

agentguard hermes-kanban demo

Govern board tasks with local spend caps, profile capability ceilings, Reviewer Cascade gates, and signed DAG receipt trees.

guide →

OpenClaw

openclaw skill install agentguard-spend

AgentSkills-compatible skill folder. wrap() + wrap_anthropic() helpers for the skill author.

code →

Production Storage

Redis (multi-process spend tracking)

Multiple agent processes sharing one spend budget. Uses Redis INCRBY for atomic per-window increment.

Python · pip install "agentguard-spend[redis]"
import redis.asyncio as aioredis
from agentguard_spend.adapters.redis_store import (
    RedisSpendStore, RedisDecisionLogStore,
)

r = aioredis.from_url("redis://localhost:6379/0")
config = SpendGuardConfig(
    policy=policy,
    spendStore=RedisSpendStore(r, key_prefix="agentguard"),
    logStore=RedisDecisionLogStore(r, stream_key="agentguard:log"),
    signingKeys=keys,
)

TypeScript · npm install ioredis
import Redis from 'ioredis';
import {
  RedisSpendStore, RedisDecisionLogStore,
} from '@agentguard-run/spend/dist/adapters/redis-store';

const redis = new Redis('redis://localhost:6379');
const config = {
  policy,
  spendStore: new RedisSpendStore(redis),
  logStore: new RedisDecisionLogStore(redis),
  signingKeys: { privateKey, publicKey },
};

PostgreSQL (multi-tenant SaaS)

Atomic UPSERT for window spend, JSONB decision payload, UNIQUE(signer_fingerprint, sequence) for chain integrity.

Python · pip install "agentguard-spend[postgres]"
from agentguard_spend.adapters.postgres_store import (
    PostgresSpendStore, PostgresDecisionLogStore,
)

spend = await PostgresSpendStore.connect("postgresql://user:pass@host/db")
log = await PostgresDecisionLogStore.connect("postgresql://user:pass@host/db")
await spend.ensure_schema()
await log.ensure_schema()

config = SpendGuardConfig(policy=policy, spendStore=spend, logStore=log, signingKeys=keys)

TypeScript · npm install pg
import { Pool } from 'pg';
import {
  PostgresSpendStore, PostgresDecisionLogStore, ensureSchema,
} from '@agentguard-run/spend/dist/adapters/postgres-store';

const pool = new Pool({ connectionString: process.env.DATABASE_URL });
await ensureSchema(pool);
const config = {
  policy,
  spendStore: new PostgresSpendStore(pool),
  logStore: new PostgresDecisionLogStore(pool),
  signingKeys,
};

Enterprise Key Management

AWS KMS (Python only: v0.1.10)

Private signing key never leaves AWS KMS. Sign requests are delegated; SDK only handles the resulting signature.

Python · pip install "agentguard-spend[kms]"
from agentguard_spend.adapters.kms_signing import AwsKmsSigningKeys

keys = AwsKmsSigningKeys(
    key_id="alias/agentguard-prod",
    region="us-east-1",
)
config = SpendGuardConfig(policy=policy, signingKeys=keys, ...)

HashiCorp Vault Transit (Python only: v0.1.10)

Python · pip install "agentguard-spend[vault]"
from agentguard_spend.adapters.kms_signing import VaultTransitSigningKeys

keys = VaultTransitSigningKeys(
    key_name="agentguard-prod",
    vault_url="https://vault.acme.com",
    token=os.environ["VAULT_TOKEN"],
)

LangChain (Python): full example

from langchain_openai import ChatOpenAI
from agentguard_spend.integrations.langchain_callback import (
    AgentGuardSpendCallbackHandler,
)

handler = AgentGuardSpendCallbackHandler(
    daily_cap_dollars=20,
    agent_id="my-langchain-agent",
    soft_cap_dollars=5,
    downgrade_to="gpt-4o-mini",
)
llm = ChatOpenAI(model="gpt-4o", callbacks=[handler])
llm.invoke("hello")  # raises AgentGuardBlockedError if cap exceeded

LangChain.js: full example

import { ChatOpenAI } from '@langchain/openai';
import { AgentGuardSpendCallbackHandler } from
  '@agentguard-run/spend/dist/integrations/langchain-callback';

const handler = new AgentGuardSpendCallbackHandler({
  dailyCapDollars: 20,
  agentId: 'my-langchain-agent',
  softCapDollars: 5,
  downgradeTo: 'gpt-4o-mini',
});
const llm = new ChatOpenAI({ model: 'gpt-4o', callbacks: [handler] });
await llm.invoke('hello');  // throws AgentGuardBlockedError if cap exceeded

CrewAI: full example

from crewai import Agent, Crew
from agentguard_spend.integrations.crewai_wrap import guard_crew

crew = Crew(agents=[researcher, writer, reviewer])
guard_crew(crew, daily_cap_dollars=50, per_agent_cap_dollars=20)
crew.kickoff()  # spend governed per-agent + total

LlamaIndex: full example

from llama_index.llms.openai import OpenAI as LlamaOpenAI
from agentguard_spend.integrations.llamaindex_wrap import guard_llm

llm = guard_llm(
    LlamaOpenAI(model="gpt-4o"),
    daily_cap_dollars=20,
)
response = llm.complete("Hello")  # caps enforced

Hermes Agent (Nous Research): full example

Install the pip plugin in the same virtualenv as Hermes:

cd ~/.hermes/hermes-agent
uv pip install agentguard-spend-hermes

Restart Hermes. On first start the plugin auto-bootstraps a policy + Ed25519 keypair under ~/.hermes/agentguard/, monkey-patches the Anthropic + OpenAI client constructors, and starts policy-checking every LLM call. Zero application code changes.

OpenClaw: full example

Drop the AgentGuard skill into ClawHub or your local OpenClaw skills directory. Then in your agent code:

from openai import OpenAI
from agentguard_skills.openclaw_agentguard_spend import wrap

client = wrap(
    OpenAI(base_url="https://openrouter.ai/api/v1",
           api_key=os.environ["OPENROUTER_API_KEY"]),
    agent_id="my-openclaw-agent",
)

The full CLI from any install

Same five commands across Python and Node, after any of the above installs:

agentguard init       # scaffold a policy + quickstart
agentguard demo       # marketing trace, real signature, 30 sec
agentguard verify     # cryptographic verification of the demo receipt
agentguard doctor     # health check (✓ crypto, ✓ providers, ✓ policy, ✓ block)
agentguard explain    # cap math + signature breakdown of any receipt
agentguard serve      # local dashboard at http://localhost:8787

Patent notice: Protected by U.S. patent-pending technology (App. Nos. 63/983,615; 63/983,621; 63/983,843; 63/984,626; 64/071,781; 64/071,789; plus DV-2026-007 in active filing). See /patents.