AxioRank Docs
Integrations

OpenAI Agents

Guard the tools an OpenAI Agents SDK agent runs, in TypeScript or Python.

AxioRank guards the execute handler you hand to tool(...), so every invocation is scored before it runs. Wrapping the handler (rather than the built tool object) is robust to the SDK's internal tool shape.

npm install @axiorank/sdk

guardExecute(name, fn, axio, opts) wraps just the handler; guardToolConfig wraps the whole config and reads the name for you.

import { tool } from "@openai/agents";
import { AxioRank } from "@axiorank/sdk";
import { guardExecute, guardToolConfig } from "@axiorank/sdk/openai-agents";
import { z } from "zod";

const axio = new AxioRank({ apiKey: process.env.AXIORANK_API_KEY! });

// Option A - wrap just the execute function:
const refund = tool({
  name: "refund",
  description: "Refund a charge",
  parameters: z.object({ chargeId: z.string(), amount: z.number() }),
  execute: guardExecute("refund", async ({ chargeId, amount }) => doRefund(chargeId, amount), axio),
});

// Option B - wrap the whole config (name is read for you):
const deploy = tool(
  guardToolConfig(
    {
      name: "deploy",
      description: "Deploy to production",
      parameters: z.object({ service: z.string() }),
      execute: async ({ service }) => doDeploy(service),
    },
    axio,
    { onDeny: "return" },
  ),
);
pip install "axiorank[openai-agents]"

The SDK invokes tools asynchronously, so pass an AsyncAxioRank. guard_tool returns a drop-in FunctionTool.

from agents import Agent, function_tool
from axiorank import AsyncAxioRank
from axiorank.integrations.openai_agents import guard_tool

axio = AsyncAxioRank(api_key="axr_live_...")

@function_tool
async def deploy(service: str) -> str:
    return await do_deploy(service)

safe_deploy = guard_tool(deploy, async_client=axio, on_deny="return")
agent = Agent(name="ops", tools=[safe_deploy])

Recover or fail

onDeny: "return" / on_deny="return" hands the model a short refusal it can re-plan around, the natural choice for an agent. Omit it and a denied call raises instead.

Next steps

On this page