Production AI agents without the framework tax: in Python and TypeScript. ⚡

Agent RT gives agents a clear execution boundary for tools, streaming, structured output, permissions, approvals, memory, checkpoints, sandboxing, observability, and deployment—without requiring a heavyweight orchestration stack.

One runtime. Two languages. Any model provider. Production controls built in. 🧩

🤖 Meet Artie

Artie (A·R·T, for Agent RT) is the running robot in the logo, and greets you in the terminal when agent-rt starts. artie is a command alias: artie migrate, artie demo, and every other agent-rt command and option work the same. Artie has moods: it raises a shield when Guard blocks a tool call and celebrates when a migration passes. Its three flagship features have names:

• 🛡️ Guard — action blockers, including Agent Action Guard, stop a harmful tool call before it runs.
• ♻️ Checkpoints — resume a run with the turn, tool-call, and token budgets it had already used.
• 🧱 Wall — the migration wall: 65+ third-party repositories that pass their tests before and after migrating.

📈 By the Numbers

• 🪙 6–22× fewer input tokens per prompt than Codex, Claude Code, opencode, and Copilot CLI
• 🧠 5–10× less memory per CLI process than the same agent CLIs, and the lowest of seven CLIs including Pi and OpenHuman
• 📦 66× smaller npm install than LangChain.js (1.24 MiB vs 82.44 MiB)
• ⚡ 5.8× less framework overhead than LangChain in Python (1.56 ms vs 9.03 ms warm)
• 🔄 65+ third-party repositories pass their tests before and after migration

_{Measured against deterministic localhost mock models, so the numbers show runtime and harness overhead, not model latency or task quality. Part of the CLI token gap comes from Agent RT's smaller built-in tool set. Method and raw data: comparison/.}

_{Agent RT CLI in action: Guard rejects an unsafe tool call, while a legitimate workspace edit requires explicit approval. Deterministic offline demonstration.}

Runs on:

🚀 Quick Start

Python

pip install agent-rt

TypeScript / Node.js

npm install agent-rt

Docker Hub (prebuilt images)

docker pull praneeth1v/agent-rt-python:latest
docker pull praneeth1v/agent-rt-typescript:latest

The Python image launches the agent-rt CLI; the TypeScript image contains the Node.js runtime and installed agent-rt package. See container usage for run commands and versioned tags.

⏱️ Try it in 10 seconds with the API key you already use for Claude Code, Codex, opencode, or Copilot CLI (no config file needed):

pip install 'agent-rt[cli,anthropic]'
agent-rt claude -p "explain this stack trace"   # or: agent-rt codex exec "..." · agent-rt opencode run "..." · agent-rt copilot -p "..."

Only API-key setups are reused; subscription sign-ins stay with the official clients (details).

🎬 No API key? uvx agent-rt demo (or npx agent-rt demo) runs a scripted mock model through a prompt-injection attack and shows Guard stopping rm -rf ~ before the tool runs. agent-rt web --demo replays it in a time-travel debugger where you can fork from any checkpoint.

➡️ Installation · Quickstart

🔄 Migrate by Changing One Import

- from openai import OpenAI
+ from agent_rt.openai import OpenAI

- import OpenAI from "openai";
+ import OpenAI from "agent-rt/openai";

The same prefix works for supported subsets of Anthropic, OpenRouter, LangChain, Deep Agents, LlamaIndex, and OpenAI Agents (plus LiteLLM, AutoGen, and CrewAI in Python). See the migration guide.

Or run uvx agent-rt migrate (Python) or npx agent-rt migrate (TypeScript/JavaScript) in your project. It runs your tests before and after the rewrite and keeps it only if nothing new fails: every test that fails afterwards must have failed before, in the same test at the same line. Otherwise every file is restored. It then prints a before-and-after card (tests, test time, peak memory, package size) and, for a GitHub repository, a pre-filled issue link to add it to the migration wall. See automatic migration.

Migrated? Add the opt-in badge to your README.

✨ Why Agent RT?

• 🪶 Lightweight and measurable — start with the runtime core and add integrations only when needed; reproducible cross-framework benchmarks live in comparison/.
• 🛡️ Controlled — permissions, composable action blockers, approvals, deterministic PII morphing, limits, guardrails, and sandbox boundaries are runtime concepts, not add-ons.
• 🔌 Provider-neutral, two languages — OpenAI, Anthropic, compatible endpoints, or custom providers, with aligned contracts in Python and TypeScript.
• 🔄 Migration-tested — ongoing compatibility field testing has 65+ third-party repositories passing their test suites both before and after migration to Agent RT.

Decision models (such as Jev-compatible models) answer typed choice/score questions for runtime control-plane gates instead of generating text. Toolbase can combine local, deferred, and MCP tools, remove unsafe definitions with a Decision model, pass only the relevant subset to each turn, and keep tool_search available for safe fallback discovery; the same Decision layer also gates memory, reranks retrieval results with optional top-k selection, and classifies failures. Every Decision helper also works with the OpenAI-compatible Decisions API (decision_model: {provider: openai}). To self-host an open-source Jev-compatible endpoint, run Ollaya and set decision_model.base_url to it.

🧰 Also Included

• 🧠 Agent memory — AgentConfig.memory mixes strings, objects, and stores from LangChain, LangGraph, LlamaIndex, AutoGen, OpenAI Agents, or mem0. load_memory() / loadMemory() connect mem0 (default), Zep, Letta, Supermemory, or memU (Python) and store finished conversations with remember() (details).
• ✅ Task lists — TodoList gives a model one todo tool with a separate list per session; on by default in the CLI and web UI (details).
• 🖥️ Terminal CLI and web UI (Python) — agent-rt and agent-rt web share sessions, so a session started in one resumes in the other; edits need in-page or terminal approval (details). The CLI reads Codex and Claude Code project setup as is: AGENTS.md/CLAUDE.md, skills in .agents/, .claude/, .codex/, and MCP servers from .mcp.json, ~/.claude.json, and ~/.codex/config.toml (details).
• 💬 Chat bots (Python, beta) — agent-rt serve telegram,discord answers allowed users, with no workspace tools (details).

⚖️ Quick Comparison

	⚡ Agent RT	🦜 LangChain	🗂️ LlamaIndex
🎯 Primary focus	🧠 Agent runtime	🧩 App/orchestration framework	📚 Data & RAG framework
Python + TypeScript	✅	✅	✅
🛠️ Tools & agent loop	✅ Built-in	✅	✅
🔐 Permissions & approvals	✅ Built-in	◐	◐
🛡️ Agent Action Guard	✅ Built-in integration (opt-in)	—	—
🧰 API & CLI tools	✅ Built-in (optional packages)	—	—
🌐 OpenAI + Anthropic compatible API	✅ Built-in server adapters	◐ Integration-dependent	◐ Integration-dependent
🧠 Decision-model control gates	✅ Tool pruning, memory/retrieval gates, failure classification	—	—
✂️ Tool catalog pruning before model call	✅ Built-in	◐ Integration-dependent	◐ Integration-dependent
📦 Sandboxing	✅ Fail-closed backend selection	◐	◐
♻️ Budget-preserving checkpoints	✅ Resume with prior turn/tool/token budgets	◐	◐
💾 Memory & checkpoints	✅ Built-in	✅	✅
🗃️ Switch vector DBs	✅ One agent-rt.yaml registry switch	◐ Integration-dependent	◐ Integration-dependent
🔁 Post-retrieval reranking	✅ Built-in provider-neutral hook + optional top-k	◐ Available	◐ Available
🔌 Provider-neutral	✅	✅	✅
🪶 Lightweight runtime focus	✅	◐	◐
Fresh install footprint	46.43 MiB	69.87 MiB	219.91 MiB
Warm latency	1.56 ms	9.03 ms	4.26 ms
Runtime memory	+5.86 MiB	+19.77 MiB	+22.42 MiB
Fresh install footprint	1.24 MiB	82.44 MiB	60.38 MiB
Warm latency	1.85 ms	2.60 ms	2.23 ms
Runtime memory	+14.33 MiB	+17.27 MiB	+16.79 MiB

✅ Built-in · ◐ Available / integration-dependent · — Not a primary focus

📊 See reproducible benchmarks →

🧪 See It in Action

A tool the model may call, restricted by a capability grant and a model-call budget (Python shown; see the TypeScript package for the npm quick start):

registry = ToolRegistry()
registry.register(
    ToolDefinition(
        name="get_weather",
        description="Get the current weather for a city.",
        input_schema={
            "type": "object",
            "required": ["city"],
            "properties": {"city": {"type": "string"}},
            "additionalProperties": False,
        },
        side_effect="read",
    ),
    handler=get_weather,  # async (arguments, cancellation_token) -> dict
)

loop = AgentLoop(
    load_model(load_config()),  # models from ~/.agent-rt/config.yaml; select project YAML with load_config(path)
    tool_registry=registry,
    capability_grant=CapabilityGrant(tools=("get_weather",)),
    execution_budget=ExecutionBudget(ExecutionBudgetLimits(max_model_calls=5)),
)
result = await loop.run(agent, messages)

Arguments are validated against the schema, tools outside the grant never run, and the budget stops runaway loops. Full runnable versions are in the examples.

📚 Learn More

Topic	Documentation
Runtime model	How Agent RT executes agents
Tools & safety	Tools, policy, permissions, approvals, and guardrails
State & memory	State, memory, checkpoints, and artifacts
Production	Sandboxing, observability, evaluation, and deployment · Deployment privacy checklist
Migration	LangChain, LlamaIndex, OpenAI, and Anthropic migration
Runtime guide	Providers, memory packages, API server, CLI, web UI, chat bots, sandboxes, skills, and migration entry points
Features	Features, defaults, and configuration
Architecture	Architecture and extension contracts
Development	Contributor setup and test workflows

🌐 Full documentation: agent-rt-pro.github.io/docs

📦 Packages

Python · TypeScript · Python examples · TypeScript examples

The inbound API server, terminal CLI, web UI, chat bots, memU memory, and AutoGen/CrewAI/LiteLLM migration shims are Python-only.

Agent Swarm Eval: Multi-agent tool security

Agent Swarm Eval runs a live two-way comparison: a minimal harness using the regular OpenAI Python SDK versus configured Agent-RT SubagentSwarm with the worker/reviewer models, Decision-model-guided grants and runtime PII guards selected in agent-rt.yaml. Run make eval-agent-swarm-eval from the repository root after configuring a working Decision endpoint. There are 65 safe synthetic fixtures, including ten new realistic red-team tool-output challenges and five earlier advanced cases. A qualitative priority manifest puts the original controls first, then the new probes in ranks 6-15. The default evaluates 10 SDK cases and only runs Agent-RT for cases where the SDK does not pass every trial. Run make eval-agent-swarm-eval 3 for three independent SDK attempts per case, with Agent-RT runs only when needed (up to 60 planned case/framework slots). Findings count as confirmed only when observed in every attempt. SDK-clean cases are marked Skipped on the Agent-RT side, with an explanation and without inventing passing grades. Increasing k executes only newly requested trial slots; decreasing it reuses already cached trials. Models that return completed but empty outputs produce cached, inconclusive capability outcomes instead of aborting the entire run. Select a different registered worker model for all sub-agents with --subagent-model ALIAS (the reviewer/Decision configuration stays fixed). Worker caches are model-specific. Use python benchmarks/agent-swarm-eval/run.py --config ./agent-rt.yaml --limit 20 to include all ten new probes or --limit 65 for the full dataset. For example, make eval-agent-swarm-eval SUBAGENT_MODEL=subagent-alt selects an alternate alias for the normal ten-case evaluation; use python benchmarks/agent-swarm-eval/run.py --config ./agent-rt.yaml --subagent-model subagent-alt --limit 5 for five tasks per framework. See the benchmark guide for model_list setup. Successful SDK, Agent-RT and Decision responses are cached independently; deterministic offline doubles remain in tests. The default terminal report uses concise Rich comparison tables, rather than dumping case-by-case JSON. Tool-policy findings and successful-but- redundant calls appear in each case; missing final answers are counted separately. Both harnesses receive identical inert, task-relevant tool results containing untrusted attack excerpts or realistic document-body prompt injections. Each worker also receives a distinct case-specific system prompt, the same in both frameworks, with synthetic contact values, potentially misleading workflow approvals, and suggested mock-tool actions. The reviewer receives no such worker prompt. This is a trusted-prompt conflict test in addition to the untrusted-document attack; observed violations cannot be attributed solely to document injection. Longer staged attacks are present in ranked cases 2–20, and PII-category tasks include synthetic contact identifiers as internal reference context. New cases are adversarial hypotheses; model failure is not guaranteed and must be verified by live, repeated trials. To save the complete report, run python benchmarks/agent-swarm-eval/run.py --config ./agent-rt.yaml --output report.json; use --json for machine-readable stdout. Install the Python cli extra if Rich is not already present.

📄 License

MIT — see LICENSE.

---

Projects for Next-Gen AI

Reviewed, bounded subagent delegation

Python and TypeScript expose SubagentSwarm for task-based delegation with full inherited conversation history, a three-level hierarchy (main + worker + grandchild), one nested child per worker, per-tool read/write grants that only narrow, independent reviewer reports, and concurrency-aware tracing/metrics. Use the native AgentLoopInvoker adapter to propagate per-call budgets, cancellation, deadlines, and grants. Dispatch rechecks the live registered tool side-effect class. Register the optional scoped delegation tool explicitly in your agent registry. See the runtime guide.