Integrations

Agentegrity ships fourteen framework adapters (eight Python modules and six TypeScript packages) and two hook plugins for coding agents. Five frameworks have both a Python and a TypeScript adapter, so the adapters cover nine frameworks in total. The two languages do different work. A Python adapter runs the four evaluation layers in your process, keeps an attestation chain, and can deny tool calls on frameworks that give it a blocking hook. A TypeScript package does not evaluate anything locally: it maps the framework’s lifecycle to the same event stream and sends it to a backend and to any exporters you register. The hook plugins run the Python runtime as a command on every Claude Code or Codex hook event.

​

All integrations

Under enforce=True, every Python adapter except AutoGen and the Bedrock boto3 path stops a denied tool call before it runs. A block verdict always denies, an escalate verdict denies unless an approval handler approves it, and a call whose evaluation raises is denied (see Scoring and actions). What the agent sees depends on the framework: CrewAI, Google ADK, Strands and the Claude Agent SDK give the model the denial and the run continues, while LangChain, OpenAI Agents and Agno end the run with an exception. “Observation only” means the adapter evaluates every event and records the decision in the attestation chain, but the surface it hooks runs after the tool or cannot stop it, so enforce=True prevents nothing. AutoGen and the Bedrock boto3 path emit a UserWarning when you pass enforce=True.

​

Shared contract

​

Zero configuration

Every adapter works with no arguments. What “no arguments” means differs by language. A Python adapter builds a default AgentProfile and a local four-layer evaluator, and sends nothing over the network. It attaches the built-in HTTPExporter only when both AGENTEGRITY_TOKEN and AGENTEGRITY_EXPORTER_URL are set (AGENTEGRITY_URL is accepted as an alias for the URL). The hook runtime behind both coding-agent plugins uses the same rule. A TypeScript package reads AGENTEGRITY_URL and AGENTEGRITY_TOKEN when its adapter is created and sends nothing over the network unless AGENTEGRITY_URL is set. It does not read AGENTEGRITY_EXPORTER_URL. In both languages the URL must be HTTPS or a loopback address; any other URL is refused.

​

Kill switch

Only the TypeScript packages have a library-wide kill switch: AGENTEGRITY_DISABLED set to 1, true or TRUE makes every hook a no-op, including exporter fan-out (default.ts). The Python adapters read no disable variable. The coding-agent hook runtime has its own, AGENTEGRITY_HOOK_DISABLED=1. AGENTEGRITY_DISABLE (without the trailing D) is not read anywhere. To stop a Python adapter, do not call its entry point. To stop anonymous usage analytics, see Telemetry.

​

Fail-open

An instrumented agent does not fail because of Agentegrity. In Python, exporter exceptions are caught and logged, and each adapter’s framework callbacks catch their own errors (the Google ADK adapter, for example, wraps every callback so it never raises into the run). In TypeScript, every exporter call and every HTTP request is wrapped, and errors go to console.warn. The deliberate exception is enforcement: a Python adapter with enforce=True on a blocking surface denies the call, including a call it could not evaluate.

​

Idempotency

register_exporter() (Python) and registerExporter() (TypeScript) ignore an exporter instance that is already registered, and closing or ending a session twice sends on_session_end once. Both hold on every adapter. The Python conformance suite tests both; the TypeScript suite tests exporter registration. Repeated instrumentation is guarded on some adapters only:

​

Event vocabulary

Every adapter maps its framework onto the same canonical event types: user_prompt_submit, pre_tool_use, post_tool_use, post_tool_use_failure, subagent_start, subagent_stop, subagent_orphan, pre_compact, stop, task_started, the multi-agent events (topology_declared, topology_change, peer_message, shared_memory_write, broadcast), credential_declared, capture_failure, and one <channel>_overflow per capped buffer. schemas/exporter/common.json accepts any snake_case name and lists the known ones as examples, so a consumer should handle the types it knows and accept the rest. See Events for payloads.

​

Argument classification

In Python, every pre_tool_use is tagged by classify_tool_call() with the categories its arguments show: reads_sensitive, sends_external, remote_code_exec, log_tamper, obfuscated_command, runs_inline_code. A generic shell tool is judged by the command it runs, not by its name. runs_inline_code marks an interpreter given a program inline (python -c, node -e, perl -e, eval, code on stdin or in a heredoc); the command string of bash -c '…' is classified as shell instead. The classifier reads command keys (command, cmd, script, commands) and path keys (file_path, path, filename, notebook_path) in the argument dict, so it only sees what the adapter receives: The TypeScript packages do not classify. They forward the tool arguments they receive in the event payload.

​

Version parity

pyproject.toml and every published @agentegrity/* package are at v0.13.0, published 2026-10-21. CI enforces matching version strings and pinned internal-client dependencies, including the frozen Bun lockfile, with clients/typescript/scripts/check-versions.ts. The two plugin manifests carry the same version, which is the library version they need.

​

Token usage

Every adapter and both hook plugins put the session’s running token usage on each stop event and in the session summary, normalized so input_tokens always includes cached tokens. Where each integration reads its counts is listed on the Python and TypeScript pages and in Token usage.

​

Wire format

All adapters send the same JSON payloads. The contract is schemas/exporter/ (JSON Schema) and schemas/openapi.yaml (OpenAPI 3.1). tests/test_schemas.py catches Python drift, and the TypeScript packages share the EmittableEvent type from @agentegrity/client. See Exporters for the sinks.