Founding release candidate · OpenAI Agents SDK 0.19.x
AgentSafe
Test whether approval actually gated your FunctionTool execution.
Record six narrow approval-to-execution properties locally, fingerprint exact argument bytes, and fail honestly when evidence is missing.
- Instrument
- Run
- Record
- Check
One-time founding price. One organization, internal use, with all 0.x updates included.
AgentSafe is independent software from YY and is not affiliated with or endorsed by OpenAI.
The failure question
Did rejection stop the handler—and did approval come first?
An approval prompt alone does not prove that a tool waited. AgentSafe checks whether a rejected call stayed outside the handler and whether an approved call executed only after the recorded approval, with the same exact argument bytes.
Measured scope
Six checks, stated exactly
AgentSafe turns an agent run into a deterministic event record, then evaluates approval-to-execution invariants against that record. A pass means the required evidence was observed—not that every property of the agent is safe.
Rejected calls do not execute
A rejected call must produce a later resumed synthetic output without a tool execution event.
Approval precedes execution
A gated tool cannot execute before an approval event for that call.
Arguments remain identical
The approved and executed argument fingerprints must match exactly.
Execution is unique and bounded
Each observed call has no more than one execution start and one completion.
Call and output correlate
Each observed execution resolves to exactly one matching tool output.
Read-only tools avoid approval
A tool declared read-only must run without an approval interruption.
- Verified release candidate
- 0.0.1-rc7 · 6 PASS · 0 FAIL · portability gate PASS
- Test suite
- 13 passing tests across the release fixture, bypass, tampering, duplication, and missing-evidence paths
- Validated on
- Python 3.12 · OpenAI Agents SDK 0.19.1 · Linux CI
Local evidence
Inspect behavior without collecting prompts
Raw tool arguments do not enter the evidence file.
AgentSafe records SHA-256 fingerprints of the exact UTF-8 argument bytes, event ordering, approval disposition, and result correlation. The evidence stays in a local JSON file that can be checked again in CI.
agentsafe check evidence.json --gateFounding package
A small tool you can inspect and keep
- Installable Python packageWheel and source distribution for the 0.0.1 release candidate.
- Readable implementationRecorder, OpenAI adapter, audit rules, and CLI source are included.
- Integration materialQuickstart, portability-gate reference, and a GitHub Actions example.
- Verifiable downloadThe archive includes SHA-256 checksums for every release artifact.
Boundary
What this release does not claim
Narrow claims make the result useful. If your integration falls outside this boundary, AgentSafe should report that it could not observe the property—not manufacture a pass.
- A security audit, certification, legal opinion, or proof that a tool is safe
- Dynamic needs_approval callback decisions in this release
- Hosted tools, computer or shell tools, apply-patch tools, MCP tools, or custom tool implementations
- Coverage outside OpenAI Agents SDK 0.19.x FunctionTool workflows
Founding license
$49 once
Internal use by one organization, including 0.x updates. The founding price rewards early adopters while the supported adapter surface is intentionally narrow.
Not a security audit or certification. Dynamic approval callbacks and other tool types are outside this release's measured scope.