Deep Agents

Before you begin

Initialize the TypeScript or Python client as fw. Supply your model, tools, and a conversation ID for the agent sequence. Choose Shadow or Warn explicitly for observation. Effective Block mode replaces denied tool interactions and model content with safe messages. Classification failures allow execution by default. Set failOpen: false in TypeScript or fail_open: False in Python when a successful classification is required.

Create a protected agent

Deep Agents creates its own subagent graphs. Use the protected constructor to cover the root, its general-purpose subagent, and declarative subagents. In the examples below, supply your initialized fw, configured chat model, tools array or list, and a caller-generated conversationId or conversation_id for this agent sequence.

TypeScript
Python

Location: your service project directory

npm install @silmaril-security/sdk@0.7.9 deepagents langchain @langchain/core @langchain/langgraph

Location: protected agent application

import { createProtectedDeepAgent } from "@silmaril-security/sdk/adapters/deepagents"

const agent = createProtectedDeepAgent(fw, {
  model,
  tools,
  subagents: [{ name: "research", description: "Research safely" }],
  silmaril: { conversationId },
})

For a compiled subagent, use the verified factory before creating the parent:Location: protected agent application

import { createProtectedCompiledSubagent } from "@silmaril-security/sdk/adapters/deepagents"

const review = createProtectedCompiledSubagent(fw, {
  name: "review", description: "Review results", model,
})
const agent = createProtectedDeepAgent(fw, {
  model, protectedCompiledSubagents: [review],
})

Python DeepAgents requires Python 3.11 or later. The base Python SDK also supports Python 3.10, but its DeepAgents extra does not.Location: your service’s Python environment

pip install "silmaril-security-sdk[deepagents]==0.7.5"

Location: protected agent application

from silmaril_security.sdk.deepagents import create_protected_deep_agent

agent = create_protected_deep_agent(
    fw, model=model, tools=tools,
    subagents=[{"name": "research", "description": "Research safely"}],
    middleware_options={"conversation_id": conversation_id},
)

For a compiled subagent, use the verified factory before creating the parent:Location: protected agent application

from silmaril_security.sdk.deepagents import create_protected_compiled_subagent

review = create_protected_compiled_subagent(
    fw, name="review", description="Review results", model=model,
)
agent = create_protected_deep_agent(
    fw, model=model, protected_compiled_subagents=[review],
)

For a compiled subagent, use createProtectedCompiledSubagent in TypeScript or create_protected_compiled_subagent in Python. These helpers install Silmaril middleware before compiling the graph. Pass the returned spec through protectedCompiledSubagents or protected_compiled_subagents, respectively. The parent constructor verifies the exact graph and Firewall client and rejects an arbitrary compiled runnable. Root custom middleware does not automatically reach every subagent. Classification errors allow execution by default. Set silmaril: { failOpen: false } in TypeScript or middleware_options={"fail_open": False} in Python when execution requires a successful classification. The middleware checks user input before model use, tool calls before execution, tool results before the next model call, and non-streamed model output before the graph consumes it. In Block mode, denied tool calls and results become a fixed safe tool message with the original call ID. The agent may choose an allowed alternative. Repeated denials end with a fixed safe response. Denied model output is replaced before it enters graph messages. Shadow and Warn report decisions without replacing content. Already emitted streaming text cannot be recalled. TypeScript SDK 0.7.3 and later apply the repeated-denial cap only in effective Block mode. Genuine earlier Block denials remain counted, but do not halt Warn or Shadow continuation.

Verify coverage

Verify the integration on the root and each subagent. Confirm that tool checks happen before execution. Buffer streaming text when delivery requires a completed output verdict.

Start

Integrations

Guides

Operate

Deployment

SDK reference

Architecture

Before you begin

Create a protected agent

Verify coverage

​Before you begin

​Create a protected agent

​Verify coverage

Before you begin

Create a protected agent

Verify coverage