The runtime · Apache-2.0
One control runtime, three placements.
Tulip is the gate that decides whether an agent's action runs. A refund, a host isolation, an account disable — it executes only after it clears policy, holds for a human when it matters, and lands on a hash-chained audit trail that fails verification if anyone edits it. Where the gate sits — in your process, as a service, or around the code in a sandbox — is a deployment detail; the gate and the record are the product. The full documentation lives at tulipagents.ai; this page is the short version.
$ pip install tulip-agents
Drop the gate around an action your agent already takes
# drop the gate around an action your agent already takes from tulip.control import Action, admit, ControlPolicy, AuditTrail, AdmissionError policy = ControlPolicy() # prod → human trail = AuditTrail() risky = Action(name="refund", asset="cust:4821", blast_radius=1, kind="payment", environment="production") try: await admit(risky, lambda: refund("cust:4821"), policy=policy, trail=trail) except AdmissionError as e: print(e.decision.outcome) # → "require_human"; refund NOT run # Held for a human, on the audit trail. Fool the model; not the runtime.
The admit() gate
Every consequential action passes allow / deny / hold-for-a-person before it runs — enforced by the runtime, not suggested to the model.
Hash-chained AuditTrail
Every decision and action lands on a hash-chained trail; verification fails on any edit. A record, not a log.
GSAR built in
A conclusion ships only when its evidence clears the grounding bar; below it, the agent abstains and records why. Published method (arXiv:2604.23366).
8 agent shapes, one router
Single agent, pipelines, loops, orchestrator + specialists, and more — a cognitive router compiles the task into the shape, rather than you hand-wiring it.
Six frameworks, no rewrite
Wrap agents from LangChain, LangGraph, CrewAI, the OpenAI Agents SDK, LlamaIndex, and Google ADK — in Python, and in TypeScript via a gateway client.
11 integrations
SIEM, SOAR, and identity integrations, so the gate's decisions and the trail's events land in the systems a security team already watches.
SDK & bridges
The gate runs inside your agent's process: the Python SDK for agents you define, and the framework bridges for agents you already have. The shortest path from pip install to a governed action.
Gateway
The same gate as a service, for agents in any language: submit the action, get the decision, with holds that survive process restarts and a signed audit on the server side. This is how the TypeScript bridges reach the gate.
Sandboxes
The gate wrapped around code you don't fully trust, from Docker containers to Firecracker micro-VMs — the same rules at every edge, whatever the code does inside.
Quickstarts, the policy model, the bridge guides, the gateway API, and the sandbox setup are all in the runtime's own documentation — kept there, in one place, next to the code.