Integrations

All docs

Framework integrations#

Every example below uses the client you can install today:

pip install https://cainstudio.online/cainstudio-0.3.0-py3-none-any.whl
pip install "cainstudio[langchain] @ https://cainstudio.online/cainstudio-0.3.0-py3-none-any.whl"   # LangChain adapter
export CAIN_API_KEY=agt_...        # the agent's own key (see the quickstart)

(PyPI listing pending. Each snippet on this page is run against that wheel; see "How this page is checked" at the end.)

Honest status per framework. "Supported" means there is framework-specific code in the package. "Generic" means you guard the plain function the framework calls with @cainstudio.guard(), which works in any framework because every one of them ultimately calls a function to execute a tool.

Framework	Status	How
Custom Python	Supported	@cainstudio.guard() on the function that acts
LangChain	Supported	cainstudio.langchain.protect(tools)
LangGraph	Generic	guard the tool functions your nodes call
LlamaIndex	Generic	guard the function behind your FunctionTool
CrewAI	Generic	guard the function behind your @tool
OpenAI agents	Generic	guard the function you dispatch to on a tool call
Microsoft (AutoGen)	Generic	guard the function you register as a tool
Google (Vertex / ADK)	Generic	guard your FunctionDeclaration handler
TypeScript / JavaScript	Generic	the ~20-line helper in TypeScript (no npm package yet)
MCP	Supported (self-hosted)	MCPGate in the call path, see MCP
Dedicated adapters for the rest	Planned	not built

What a guard does#

import cainstudio

@cainstudio.guard()
def send_email(to: str, subject: str, body: str) -> str:
    ...                      # unchanged

Before the body runs, the call's name and arguments go to CAIN-42. If it is allowed, the function runs. Otherwise it raises instead of running: cainstudio.ActionBlocked (denied), cainstudio.ApprovalRequired (held for a human; it carries the approval id) or cainstudio.CainUnavailable (CAIN could not be asked, which is never treated as allowed). @cainstudio.guard(wait_for_approval=120) waits up to 120 seconds for a human instead of raising. Async functions work the same way.

LangChain#

For tools you did not write (third-party, built-in, already constructed), and to guard a whole list at once:

from cainstudio.langchain import protect

tools = protect([search, send_email, transfer_funds], agent_id="support-agent")
agent = create_agent(model, tools)

Names, descriptions and argument schemas are kept, so the model sees exactly the same tools. A refused or held call is not executed; by default the refusal is returned to the model as the tool's error, so the agent can explain or take another route. on_block="raise" raises instead. A missing or unknown key is not a refusal, it is misconfiguration: it always raises (ConfigurationError, AuthenticationError), in either mode, and the tool body does not run. For tools you write yourself, @cainstudio.guard() on the function is enough.

Forgetting one tool is the realistic failure mode, and it is silent. Pass the agent's whole tool list through protect() rather than picking tools one by one.

LangGraph#

Guard the tool functions rather than the nodes where you can: a node may do several things, and you want the decision attached to the consequential one.

@cainstudio.guard()
def issue_refund(order_id: str, amount: int) -> str:
    ...

OpenAI agents#

Guard the dispatch target, not the model call. The model producing a tool call is not the action; executing it is.

import json

@cainstudio.guard()
def delete_record(record_id: str): ...

def handle_tool_call(call):
    if call.function.name == "delete_record":
        return delete_record(**json.loads(call.function.arguments))

CrewAI#

from crewai.tools import tool

@tool("Refund an order")
@cainstudio.guard()
def issue_refund(order_id: str) -> str: ...

Order matters: @cainstudio.guard() goes closest to the function, so the decision is made around the real call with its real arguments.

How this page is checked#

The guard and LangChain snippets were run on 1 October 2026 against the published cainstudio-0.2.1 wheel in a clean virtual environment with langchain-core installed: the decorator, protect() with tool names and schemas preserved, and the error classes named above. A call with no key, or with an unknown key, raises before the tool body runs, and protect() keeps the tool's name, description and argument schema. Framework examples for CrewAI and OpenAI show only where the guard goes; those frameworks were not installed for the check.

The earlier version of this page used from cain import trust and cain.adapters.langchain. Those come from the cain-trust operator package, which is not installable on its own yet.