Blades
A Go framework for composing multimodal agents from models, tools, memory, middleware, and workflows.
- Source repo
- go-kratos/blades
- Stars
- ★ 815
- Last updated
- 4mo ago
- License
- MIT
- Primary language
- Go
- FA score
- 23/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformOpenAI API
- You'll need
- Typical use
- A Go backend team embedding an OpenAI-backed, multi-turn question-answering agent in an existing service.
- Main limitation
- The README lacks installation commands, a Go version, module-version guidance, and a standalone deployment path, leaving initial project setup to adopters.
- Source review
- 23/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
Blades is a multimodal AI Agent framework for Go, not a separately hosted chat application. Its common Agent execution contract is Run(context.Context, *Invocation), which returns Generator[*Message, error], and Agent, Chain, and ModelProvider can be composed around that model. The framework exposes pluggable ModelProvider, Tool, Memory, and Middleware components, while flow coordinates multi-step reasoning and transfers data and control between Agents. Model output can be collected in full with Generate or consumed incrementally through NewStreaming; the supplied example runs an OpenAI-backed agent through Runner in application code. It fits teams building agent behavior inside Go services, but the README does not document a standalone deployment, CLI, or installation command.
An application creates a ModelProvider, such as openai.NewModel("gpt-5", openai.Config{APIKey: os.Getenv("OPENAI_API_KEY")}), then creates an agent with blades.NewAgent plus WithModel and WithInstruction. The caller builds a blades.UserMessage, invokes blades.NewRunner(agent).Run(context.Background(), input), and reads Text() from the returned message. For extensions, Tool uses InputSchema and Handle to represent callable external capabilities; Memory saves and searches messages by session; Middleware adds behavior around Runner execution. Skills can be loaded with skills.NewFromDir("./skills") or skills.NewFromEmbed(embed.FS) and passed through WithSkills(...).
- A Go backend team embedding an OpenAI-backed, multi-turn question-answering agent in an existing service.
- A developer connecting several Agents or Chains into a multi-step reasoning workflow in a Go application.
- A team exposing database queries or API calls as model-callable functions with an InputSchema for invocation parameters.
- An application that needs session-scoped conversation memory so later turns can retain context.
- An engineering team adding logging, monitoring, authentication, or rate limiting around agent execution without changing Runner core logic.
How do you install or deploy this agent?
The README does not provide a copyable installation command, a required Go version, or module setup instructions, so an exact dependency-installation procedure is undocumented. The explicit prerequisites are a Go environment and, for the OpenAI example, OPENAI_API_KEY; the application must also be able to import github.com/go-kratos/blades and github.com/go-kratos/blades/contrib/openai.
How do you use this agent?
In a Go program, read OPENAI_API_KEY and create openai.NewModel("gpt-5", openai.Config{APIKey: os.Getenv("OPENAI_API_KEY")}). Create an agent with blades.NewAgent("Blades Agent", blades.WithModel(model), blades.WithInstruction("You are a helpful assistant that provides detailed and accurate information.")). Build input with blades.UserMessage("What is the capital of France?"), then run runner := blades.NewRunner(agent) followed by runner.Run(context.Background(), input). After checking err, call output.Text() to obtain the text response.
What are this agent's strengths and limitations?
- A shared Agent interface and Generator-based output model connect Agent, Chain, and ModelProvider as composable execution units.
- The ModelProvider abstraction is explicitly pluggable, with OpenAI, DeepSeek, and Gemini named as services it can integrate.
- It combines tools, session memory, streaming generation, and middleware for Go applications that need agent capabilities.
- Skills can be loaded from a directory or packaged into the binary with embed.FS.
- The README lacks installation commands, a Go version, module-version guidance, and a standalone deployment path, leaving initial project setup to adopters.
- The OpenAI example requires network access and OPENAI_API_KEY; cost and availability depend on the chosen model provider.
- Persistent and more advanced memory strategies are left to extensions; the README explicitly identifies only an InMemory implementation.
- No CLI, HTTP service surface, or production operations configuration is shown, so adopters must define the application boundary themselves.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Blades This agent | 23 · Major gaps | ★ 815 | 4mo ago | Go | OpenAI API |
| Agently AI Application Runtime | 63 · Some gaps | ★ 1.7k | 11d ago | Python | OpenAI API · Claude API |
| Dynamiq Agent Orchestration | 61 · Some gaps | ★ 1.1k | 1d ago | Python | OpenAI API |
| DSPy-Go | 49 · Major gaps | ★ 196 | 5d ago | Go | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows the repository provides no mechanisms for permission management, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution. All related criteria are absent from the files, hence score 0.
Self-consistency: README concepts align with code interfaces, but full code verification is not possible, score 1. Dependency availability: Dependencies are listed in go.mod, but availability not verified, score 1. Failure messages: No documentation on error handling or failure messages, score 0.
Audience and scenarios: README clearly targets Go developers and lists use cases like multi-turn conversation and chain-of-thought, score 2. Capability boundaries: Core components described but boundaries not explicit, score 1. Trigger precision: No trigger mechanisms provided, score 0. Environment fit: Environment variable configuration example given, but not comprehensive, score 1.
Information architecture: README well-structured with architecture diagram, score 2. Install notes: Quick start example provided, but no detailed installation steps, score 1. Naming stability: Interface names stable, but no version history, score 1. Examples and FAQ: Example code provided, but no FAQ, score 2. Known limitations: Not explicitly listed, score 1. License: MIT license file present, score 2. Versioning and changelog: No version or changelog, score 0. Maintenance responsibility: Maintainers not specified, score 1.
Output usability: Example shows output, but format not specified, score 1. Marginal value: Framework offers multimodal support, but no comparison with alternatives, score 1. Cost-benefit: No performance or cost data, score 1.
Claim traceability: Claims in README lack specific evidence, score 1. Cross-source corroboration: No external verification, score 0. Fact-inference separation: Some descriptions are inferential without clear distinction, score 1.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- The repository provides no security mechanisms such as permission control, user confirmation, or data flow transparency; assess risks before use.
- Dependencies are not security-verified and lack version pinning, posing supply chain risks.
- No version numbers or changelog, making it difficult to track updates and compatibility.
- Maintenance responsibility is unclear, raising concerns about long-term maintenance.