Operate one policy across the full agent boundary.

from imladri import Imladri

imladri = Imladri.from_env()

@imladri.action("cloud.deploy", strict_preflight=True)
def deploy_release(release):
    return deployer.deploy(release)

tools = imladri.wrap_tools(
    {"customer.read": customer_lookup, "email.send": send_email},
    strict_tools=["email.send"],
)

intent = {"customer_id": customer_id, "amount_cents": 5000}
imladri.preflight("payment.refund", intent=intent)
payment_gateway.refund(**intent)

const agent = new ConstitutionalAgent({
  agentId: process.env.IMLADRI_AGENT_ID!,
  apiKey: process.env.IMLADRI_API_KEY!,
  apiUrl: process.env.IMLADRI_API_URL!,
  preflightUrl: process.env.IMLADRI_PREFLIGHT_URL,
});

const deployRelease = agent.action(
  "cloud.deploy",
  async (changeSet: ReleasePlan) => cloud.deploy(changeSet),
  {
    strictPreflight: true,
    intent: (changeSet) => ({ service: changeSet.service, version: changeSet.version }),
  },
);

await agent.runSandboxedAction("deploy.preview", {
  command: "node",
  args: ["scripts/check-release.mjs"],
  workspaceFiles: [{ path: "plan.json", content: "{}" }],
  outputPaths: ["reports/preview.txt"],
});

import {
  ConstitutionalAgent,
  createLangChainMiddleware,
  createOpenAIAgentsToolGuard,
  normalizeOpenAIAgentsToolName,
  wrapLangChainTools,
  wrapLangGraphNodes,
  wrapLlamaIndexTools,
  wrapOpenAIAgentsTools,
  wrapVercelAITools,
  wrapMastraTools,
} from "@imladri/sdk";
import { Agent, tool as openAIAgentsTool } from "@openai/agents";
import { tool } from "langchain";
import { traceable } from "langsmith/traceable";
import * as z from "zod";

const agent = new ConstitutionalAgent({ agentId, apiKey, apiUrl, preflightUrl });

const tracedCustomerLookup = tool(
  traceable(async ({ customerId }) => `customer:${customerId}`, {
    name: "customer.lookup",
    run_type: "tool",
  }),
  {
    name: "customer.lookup",
    description: "Look up a customer by id.",
    schema: z.object({ customerId: z.string() }),
  },
);

const guardedLangChainTools = wrapLangChainTools(agent, [tracedCustomerLookup], {
  strictTools: ["payment.transfer", "cloud.deploy"],
});

const langChainMiddleware = createLangChainMiddleware(agent);
// Pass middleware to the LangChain JS agent setup that owns raw tool dispatch.

const transferAction = "payment.transfer";
const transferToolName = normalizeOpenAIAgentsToolName(transferAction);
const guardedOpenAITools = wrapOpenAIAgentsTools(agent, [
  openAIAgentsTool({
    name: transferToolName,
    description: "Transfer funds after approval.",
    parameters: z.object({ amountUsd: z.number() }),
    execute: async ({ amountUsd }) => ({ ok: true, amountUsd }),
  }),
], {
  strictTools: [transferAction],
  actionAliases: { [transferToolName]: transferAction },
});

const openAIAgent = new Agent({
  name: "Payments operator",
  instructions: "Use tools only for approved workflows.",
  tools: guardedOpenAITools,
});

const openAIGuard = createOpenAIAgentsToolGuard(agent, {
  strictTools: [transferAction],
  actionAliases: { [transferToolName]: transferAction },
});

const guardedGraphNodes = wrapLangGraphNodes(agent, nodes, {
  strictTools: ["secrets.read"],
});

const guardedVercelTools = wrapVercelAITools(agent, aiTools, {
  strictTools: ["email.send"],
});

const guardedLlamaTools = wrapLlamaIndexTools(agent, llamaTools, {
  strictTools: ["customer.data.export"],
});

const guardedMastraTools = wrapMastraTools(agent, mastraTools, {
  strictTools: ["cloud.deploy.production"],
});

# MCP server uses short-lived authority from an approved design-partner workspace
IMLADRI_AGENT_ID=<pilot-agent-id> \
IMLADRI_AUTHORITY_TOKEN=<pilot-issued-token> \
IMLADRI_WORKER_URL=https://<worker> \
node mcp-server/server.mjs

# Access preview keeps scanner artifacts local
imladri scan init-ci --provider gitlab --output .gitlab-ci-imladri.yml

IMLADRI_SCAN_WORKER_URL=https://<worker> \
IMLADRI_SCAN_AGENT_ID=<pilot-agent-id> \
IMLADRI_SCAN_SDK_KEY=<pilot-sdk-key> \
imladri scan --path . \
  --config .imladri-scan.json \
  --format json \
  --output imladri-boundary.json \
  --fail-on new

# Private design partners can export a signed proof packet during onboarding
imladri proof export --format json --output imladri-proof.json