DeerFlow Guardrails

Pre-tool-call authorization for ByteDance's multi-agent system

Python

DeerFlow is a LangGraph-based AI super agent system by ByteDance with sandbox execution, persistent memory, and subagent delegation. APort guardrails add deterministic, policy-driven authorization to every tool call via DeerFlow's native middleware chain.

DeerFlow Repo (32k stars)Integration Docs

Quick Start

1. Create passport & config

setup

npx @aporthq/aport-agent-guardrails deerflow

2. Install guardrails package

install

uv add aport-agent-guardrails

3. Add to your code

code

# config.yaml
guardrails:
  enabled: true
  passport: ~/.aport/deerflow/aport/passport.json
  provider:
    use: aport_guardrails.providers.generic:OAPGuardrailProvider

Test the authorization boundary

Installer target: deerflow. Aliases: none; use the target ID.

DeerFlow setup

npx @aporthq/aport-agent-guardrails deerflow

Denied-action example

Read .env.aport-smoke-test with a passport that blocks .env* paths.

Expected policy result: deny. Use an empty test file. In warn mode the runtime may continue; enforce mode must stop the read. Hosted mode can record the decision; local mode does not prove hosted audit persistence.

Expected policy result, illustrative

{
  "policy_id": "data.file.read.v1",
  "allow": false,
  "reason": "oap.blocked_pattern"
}

Read the guardrail skill Inspect the framework passport preset

How It Works

Passport

Your agent gets an OAP passport declaring its identity, capabilities, and operational limits.

Evaluate

Before every tool call, the guardrail evaluates it against the passport's policy. Locally or via hosted API.

Decision

Allow or deny with structured OAP reason codes. Signed decisions create an auditable trail.

Frequently Asked Questions

How do I add guardrails to DeerFlow?

Install aport-agent-guardrails with pip or uv, run the setup wizard, and add the guardrails section to your DeerFlow config.yaml. The GuardrailMiddleware evaluates every tool call before execution.

Does DeerFlow guardrails work with MCP tools?

Yes. All tools including dynamically-loaded MCP tools are evaluated by the guardrail middleware before execution. MCP tools are mapped to the mcp.tool.execute.v1 policy pack.

Can I use DeerFlow guardrails without network access?

Yes. The guardrail provider supports fully local evaluation with a passport JSON file and local policy evaluator. No API calls required for air-gapped or CI environments.

Ready to secure your DeerFlow agents?

Review the setup command and denied-action check before enforcing policy.

Install my guardrail See Team Pricing

Start free for local or individual setup. Upgrade to Team for hosted org audit, signed decisions, GitHub guardrails, and shared enforcement across your team.