> ## Documentation Index
> Fetch the complete documentation index at: https://silmaril.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Deep Agents

> Protect root agents, tools, and subagents in TypeScript or Python.

## Before you begin

Initialize the [TypeScript](https://silmaril.dev/docs/sdk/typescript.md#initialize) or [Python](https://silmaril.dev/docs/sdk/python.md#initialize) client as `fw`. Supply your model, tools, and a conversation ID for the agent sequence.

Choose Shadow or Warn explicitly for observation. Effective Block mode replaces denied tool interactions and model content with safe messages. Classification failures allow execution by default. Set `failOpen: false` in TypeScript or `fail_open: False` in Python when a successful classification is required.

## Create a protected agent

Deep Agents creates its own subagent graphs. Use the protected constructor to
cover the root, its general-purpose subagent, and declarative subagents. In the
examples below, supply your initialized `fw`, configured chat `model`, `tools`
array or list, and a caller-generated `conversationId` or `conversation_id` for
this agent sequence.

**TypeScript**

Location: your service project directory

```bash theme={"theme":"github-light-default"}
npm install @silmaril-security/sdk@0.7.9 deepagents langchain @langchain/core @langchain/langgraph
```

Location: protected agent application

```typescript theme={"theme":"github-light-default"}
import { createProtectedDeepAgent } from "@silmaril-security/sdk/adapters/deepagents"

const agent = createProtectedDeepAgent(fw, {
  model,
  tools,
  subagents: [{ name: "research", description: "Research safely" }],
  silmaril: { conversationId },
})
```

For a compiled subagent, use the verified factory before creating the parent:

Location: protected agent application

```typescript theme={"theme":"github-light-default"}
import { createProtectedCompiledSubagent } from "@silmaril-security/sdk/adapters/deepagents"

const review = createProtectedCompiledSubagent(fw, {
  name: "review", description: "Review results", model,
})
const agent = createProtectedDeepAgent(fw, {
  model, protectedCompiledSubagents: [review],
})
```

**Python**

Python DeepAgents requires **Python 3.11 or later**. The base Python SDK also supports Python 3.10, but its DeepAgents extra does not.

Location: your service's Python environment

```bash theme={"theme":"github-light-default"}
pip install "silmaril-security-sdk[deepagents]==0.7.5"
```

Location: protected agent application

```python theme={"theme":"github-light-default"}
from silmaril_security.sdk.deepagents import create_protected_deep_agent

agent = create_protected_deep_agent(
    fw, model=model, tools=tools,
    subagents=[{"name": "research", "description": "Research safely"}],
    middleware_options={"conversation_id": conversation_id},
)
```

For a compiled subagent, use the verified factory before creating the parent:

Location: protected agent application

```python theme={"theme":"github-light-default"}
from silmaril_security.sdk.deepagents import create_protected_compiled_subagent

review = create_protected_compiled_subagent(
    fw, name="review", description="Review results", model=model,
)
agent = create_protected_deep_agent(
    fw, model=model, protected_compiled_subagents=[review],
)
```

For a compiled subagent, use `createProtectedCompiledSubagent` in TypeScript or
`create_protected_compiled_subagent` in Python. These helpers install Silmaril
middleware before compiling the graph. Pass the returned spec through
`protectedCompiledSubagents` or `protected_compiled_subagents`, respectively.
The parent constructor verifies the exact graph and Firewall client and rejects
an arbitrary compiled runnable. Root custom middleware does not automatically
reach every subagent. Classification errors allow execution by default. Set
`silmaril: { failOpen: false }` in TypeScript or
`middleware_options={"fail_open": False}` in Python when execution requires a
successful classification.

The middleware checks user input before model use, tool calls before execution,
tool results before the next model call, and non-streamed model output before
the graph consumes it. In Block mode, denied tool calls and results become a
fixed safe tool message with the original call ID. The agent may choose an
allowed alternative. Repeated denials end with a fixed safe response. Denied
model output is replaced before it enters graph messages. Shadow and Warn
report decisions without replacing content. Already emitted streaming text
cannot be recalled.

TypeScript SDK 0.7.3 and later apply the repeated-denial cap only in effective Block
mode. Genuine earlier Block denials remain counted, but do not halt Warn or
Shadow continuation.

## Verify coverage

[Verify the integration](https://silmaril.dev/docs/start/verify.md) on the root and each subagent. Confirm that tool checks happen before execution. Buffer streaming text when delivery requires a completed output verdict.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.