TealTiger
Deterministic security, cost governance, and audit evidence for AI applications.
- Source repo
- agentguard-ai/tealtiger
- Stars
- ★ 33
- Last updated
- today
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 65/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- Engineering teams maintaining OpenAI or Anthropic applications that want request auditing, cost attribution, and PII reporting without redesigning their call flow.
- Not a fit if
- Enterprises needing production multi-tenancy, RBAC, or SSO today
- Teams requiring verified observe() coverage for Cohere or Mistral
- Teams expecting every SDK source tree directly inside one repository
- Source review
- 65/100 · Some gaps
What does this agent do, and when should you use it?
TealTiger is an open-source runtime governance SDK for LLM applications and AI agents, with TypeScript and Python interfaces. It wraps model clients to inspect requests for prompt injection, PII, secrets, and moderated content while tracking costs and budgets. TealEngine evaluates deterministic policies in ENFORCE, MONITOR, or REPORT_ONLY modes and can produce a structured record for every verdict. Named modules such as TealProof, TealAudit, TealMonitor, TealMemory, and TealDrift cover evidence, auditing, cost, memory, and behavioral governance. The core runs as an embedded library without separate governance infrastructure, while an optional dashboard can be run locally; this repository is a hub, with the primary SDK sources stored in separate repositories or Git submodules.
An application can wrap an existing LLM client with observe(client) to collect per-request costs, correlation IDs, audit events, REPORT_ONLY PII findings, and P50/P95/P99 behavioral baselines; freeze() and unfreeze() control its emergency stop state. For active blocking, TealOpenAI accepts options such as piiDetection, promptInjection, contentModeration, per-request limits, and daily budgets. TealEngine reads policies and returns deterministic ALLOW or denial decisions, while related modules govern tool allowlists, session timing, memory-write provenance, and inherited workflows. Decisions can yield reconstructable evidence exported as JSON, SARIF, or JUnit XML; TealProof also describes Merkle-tree receipts and RFC 3161 timestamping. The dashboard fetches panels independently and displays request and cost KPIs, budget forecasts, defense stages, drift alerts, freeze state, model routing, and protocol-policy results.
- Engineering teams maintaining OpenAI or Anthropic applications that want request auditing, cost attribution, and PII reporting without redesigning their call flow.
- Teams operating tool-using agents that need tool allowlists and argument-level PII rules to stop unauthorized or sensitive operations.
- Security platforms introducing deterministic policies gradually through ENFORCE, MONITOR, and REPORT_ONLY modes while retaining reconstructable evidence.
- Teams controlling multi-model expenditure through per-request, session, or daily ceilings and circuit breakers for runaway loops.
- Operators managing a fleet of agents who need a local dashboard for spend, denials, behavioral drift, and frozen-agent status.
How do you install or deploy this agent?
Choose either supported SDK path. For Python:
pip install tealtigerFor a TypeScript project:
npm install tealtigerThe supplied governance tutorial can run without a model API key:
python examples/quickstart_governance.pyThe live OpenAI examples require OPENAI_API_KEY in the environment. This hub does not contain all SDK source directly; clone its submodules when a complete source checkout is required:
git clone --recurse-submodules https://github.com/agentguard-ai/tealtiger.gitHow do you use this agent?
The minimal Python flow creates a guarded TealOpenAI client and makes a normal chat request:
import os
from tealtiger import TealOpenAI
client = TealOpenAI(
api_key=os.environ["OPENAI_API_KEY"],
guardrails={"prompt_injection": True},
)
response = client.chat.completions.create(
model="gpt-4o-mini",
messages=[{"role": "user", "content": "Hello!"}],
)
print(response.security.decision)For lower-touch observation, wrap an existing client:
from tealtiger.observe import observe, freeze
client = observe(OpenAI())
print(client.get_cost())Run the local dashboard API and web interface separately:
cd dashboard/api
npm run devcd dashboard/web
npm run devThe API uses port 3100 and the UI uses port 3000. Validate a JSON policy before CI/CD or runtime use with:
npm install
npx ts-node scripts/validate-policy.ts ./my-policy.jsonWhat are this agent's strengths and limitations?
- The governance path does not call an LLM, so identical input and policy are intended to produce reproducible decisions.
observe(client)combines cost records, correlation IDs, PII reporting, behavioral baselines, and emergency freezing behind a small integration surface.- Both TypeScript and Python SDKs are documented, with provider paths for OpenAI, Anthropic, Gemini, Bedrock, Azure OpenAI, Cohere, and Mistral.
- Evidence formats include JSON, SARIF, JUnit XML, OpenTelemetry spans, and described SIEM integration points.
- Governance adapters are documented for 13 agent frameworks, including concrete packages for LangChain, Vercel AI SDK, PydanticAI, Haystack, and CAMEL-AI.
- Provider maturity varies: only selected OpenAI and Anthropic models are marked as end-to-end verified through
observe(); Gemini, Bedrock, and Azure OpenAI lack that integration, while Cohere and Mistral lack SDK hooks. - The repository is a hub rather than the complete SDK source tree; the main TypeScript and Python implementations live in separate repositories.
- Multi-tenancy, RBAC, SSO, policy staging, and scheduled compliance reports are listed as planned v1.5.0 work.
- The SaaS control plane, Kubernetes Operator, shadow-agent discovery, and remote kill switch are future v2.0.0 items rather than current capabilities.
- Live model calls still require provider credentials, network access, and any usage fees charged by those providers.
How does this agent compare with similar options?
Unlike probabilistic safety filters, TealTiger explicitly uses a deterministic, no-LLM policy path: the same input and policy should yield the same outcome, with reconstructable evidence for each verdict. The source does not provide a feature-by-feature comparison against a named competing product.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| TealTiger This agent | 65 · Some gaps | Library / SDKFree + model costs | ★ 33 | today | TypeScript | OpenAI API · Claude API |
| Node9 | 82 · Good | CLIFreemium | ★ 216 | today | TypeScript | Codex · Claude Code |
| Kontext | 83 · Good | CLIFreemium | ★ 221 | 3d ago | Go | Codex · Claude Code |
| OpenBot: AI Coworkers You Can Trust with Real Work | 57 · Major gaps | Self-hosted serviceFree + model costs | ★ 5.6k | 3d ago | TypeScript | — |
How does FollowAgents rate this agent?
Why each dimension lost points
The evidence describes tool allowlists, identity scopes, budget ceilings, MONITOR/ENFORCE/REPORT_ONLY modes, audit records, PII and secret detection, and private vulnerability reporting; the adapter CI workflow also limits itself to contents: read. Deductions apply because the core SDK implementations live in other repositories, preventing complete verification of permissions and data flows; there is no general per-action user-confirmation mechanism for external tools; the benchmark workflow has write access and automatically commits results; dependencies use broad ranges and the sidecar uses latest; and recovery is mostly limited to unfreeze and monitor-before-enforce rather than comprehensive policy or state rollback. Attribution points to the TealTiger team, contributors, and contact channels, but publisher identity remains unverified.
Offline KYC tests cover thresholds, hard overrides, deterministic records, validation, fallback behavior, and audit structure, while the README points to error-code and troubleshooting documentation. Deductions reflect material inconsistencies: the README calls 1.4.0 current, SECURITY.md calls 1.3.x the current stable line, and the private hub package is version 0.0.0; package.json also repeats React and React DOM with conflicting versions. Actual SDK availability depends on separate repositories or submodules, and benchmarks depend on a latest-tagged sidecar, so availability and consistency cannot be established fully from this snapshot.
The documentation offers a progressive path from zero-config observation through guardrails and policy engines to organization workflows, covering several providers, frameworks, languages, and a detailed KYC scenario. Boundaries are partially explained through deterministic local governance, the no-LLM policy path, enforcement modes, and the explicit residual risk that users can remove the SDK. Triggers are reasonably concrete in policy thresholds, allowlists, environment variables, and mode selection. Deductions apply because many adapters and providers appear only in feature lists, core implementations are outside the supplied evidence, and exact adapter behavior, deployment prerequisites, and platform differences are incomplete.
The README has strong organization across quick starts, features, SDK and adapter tables, documentation, contribution, security, and roadmap sections. It supplies TypeScript and Python installation examples, an examples tree, FAQ and troubleshooting references, and a complete Apache-2.0 license. Deductions apply for unstable version and naming signals across hub version 0.0.0, README version 1.4.0, SECURITY.md version 1.3.x, and several repositories and package names. Limitations mention SDK removal and the absence of a PGP key but are not comprehensive. A roadmap and update channels exist, but no actual changelog content is supplied. Maintenance channels are clear, though no verified publisher or named accountable maintainer is established.
Structured governance decisions, correlation IDs, audit records, cost summaries, SARIF/JUnit/JSON exports, and dashboard panels would be operationally useful. Combining security, cost, evidence, and framework adapters also offers plausible marginal value over a single-purpose filter. Deductions apply because broad effectiveness claims—such as 500-plus secret patterns, all OWASP agentic risks, seven-provider coverage, and under-5ms overhead—are not substantiated by supplied implementations or result artifacts. The operational cost of wrappers, policy configuration, dashboards, and multi-repository dependencies is not compared or quantified.
Some claims map to named modules, examples, a policy schema, tests, and CI definitions. The KYC tests corroborate deterministic decisions, fallback behavior, human-review escalation, and audit fields, while SECURITY.md supports parts of the stated governance model. Deductions apply because central product implementations reside in omitted language repositories or submodules, benchmark result files are absent, and badges or links are not substitutes for static evidence. The README frequently places released capabilities, coverage claims, performance figures, and future plans together without consistently separating verified facts from promotional assertions.
- This assessment uses only the supplied static files; the core TypeScript and Python SDKs reside in other repositories or submodules and were neither executed nor independently verified.
- Version signals conflict: the README presents 1.4.0, the security policy calls 1.3.x current stable, and the private hub package reports 0.0.0.
- Do not rely on README claims about performance, provider coverage, secret-pattern counts, cryptographic proof, or complete OWASP coverage without reviewing the corresponding implementation, lockfiles, and release artifacts.
- The benchmark workflow uses a latest-tagged sidecar and can commit results to main, warranting additional review of supply-chain reproducibility and write boundaries.
- Before production use of ENFORCE, automatic rejection, freezing, or KYC decisions, validate human-review paths, false-positive handling, policy rollback, and audit-data retention.
FAQ
Do I have to use OpenAI?
observe().Can I evaluate it without a model API key?
pip install tealtiger, the five-minute examples/quickstart_governance.py tutorial is documented as requiring no API key. Real hosted-model requests still require that provider's credentials.Does every policy violation block the request?
Does it require a separate governance service?
How can an operator stop a runaway agent?
freeze() and unfreeze() provide an immediate kill-switch mechanism. TealEngine FREEZE rules additionally describe immutable emergency controls with tamper detection.