SponsioLabs/Sponsio

Sponsio – Runtime Guardrails for AI Agents

What it is – Sponsio is a lightweight, open‑source library that sits between an LLM‑powered agent (e.g., a LangChain, Claude, OpenAI, or CrewAI bot) and the tools the agent wants to call. It evaluates contracts – deterministic, formal‑method‑backed rules – for every tool invocation and can pass, block, warn, or escalate the call. The checks run in microseconds and never invoke another model, making them far cheaper and more predictable than “LLM‑as‑judge” approaches.

Core ideas

Concept	Explanation
Agent contract	A runtime rule (expressed in a small YAML DSL) that is enforced on each agent action. Contracts can look at the current call and the history of previous calls, enabling policies like “only issue a refund after the user has been verified”.
Deterministic enforcement	Contracts are compiled to a fuzzy Linear‑Temporal‑Logic (LTL) monitor. The monitor decides in < 0.01 ms whether to allow the call, without any LLM inference.
Formal‑methods backing	The rule language is designed to be provably sound; the docs include a primer on the underlying formal methods.
Extensible contract library	22 ready‑made bundles (e.g., `destructive`, `shell`, `filesystem`) cover common risky patterns. Bundles are just YAML includes, so adding a new bundle is a single line change.
Local‑first, optional cloud console	Enforcement runs entirely on the host machine; a hosted console (`app.sponsio.dev`) can be used to view runs, review rulebooks, and publish vetted contracts.

How it works (high‑level)

Onboarding – Run sponsio init . (or use the one‑shot prompt for Claude/Code) and the wizard creates a sponsio.yaml that detects your framework (LangChain, CrewAI, etc.) and injects the appropriate wrapper code.

Wrap the agent – Import the SDK and attach a guard:

import sponsio, sponsio.bridge
guard = sponsio.Sponsio(config="sponsio.yaml", agent_id="mailer", mode="enforce")
run = sponsio.bridge.attach(guard)   # all subsequent tool calls go through the guard

Contract evaluation – For each tool call the monitor checks the relevant contracts (e.g., “no destructive SQL during a code‑freeze”). The decision is returned instantly (p50 ≈ 0.005 ms).
Audit & review – Every decision is logged locally and optionally streamed to the hosted console, where a human can approve or edit a rulebook before it becomes active.

Quick start (Python example)

pip install --pre sponsio          # or npm i -D @sponsio/sdk@alpha for TypeScript
sponsio init .                     # wizard creates sponsio.yaml

Add a bundle in sponsio.yaml:

agents:
  my_agent:
    workspace: "/srv/my-bot"
    include:
      - sponsio:capability/destructive
      - sponsio:capability/filesystem

Run your agent with the guard as shown above. The agent will now be blocked from any destructive SQL or unsafe filesystem operation unless a contract explicitly permits it.

Performance & safety numbers (from the repo)

Benchmark	Metric	Result
ODCV‑Bench (12 frontier LLMs × 80 trajectories)	Misalignment avoided	95.6 % average, 100 % on 24 high‑risk scenarios
Financial‑Audit‑Fraud‑Finding	Fraud attempts blocked	18/19 blocked
RedCode‑Exec (1,410 cases)	Combined pass rate	98.9 % (local), ~99 % with cloud LLM‑judge
Latency per contract	p50	0.0052 ms
Heaviest workload (19 contracts per call)	p50	0.139 ms
LLM‑as‑judge comparison	Latency	5,000‑60,000× faster (no model calls)

Who should use Sponsio?

Platform teams that expose LLM agents to end‑users (e.g., SaaS code‑assistants, autonomous bots) and need deterministic safety guarantees.
Enterprises that must enforce compliance policies (e.g., no data exfiltration, no destructive DB writes) without adding latency.
Developers building custom tool‑calling loops who want a plug‑and‑play guardrail instead of writing ad‑hoc prompt checks.

Installation & ecosystem

Language	Package	Install command
Python	`sponsio` (pre‑release)	`pip install --pre sponsio`
TypeScript/JavaScript	`@sponsio/sdk` (alpha)	`npm install -D @sponsio/sdk@alpha`

Supported integrations include LangChain, Claude Agents, OpenAI Agents, Google ADK, CrewAI, Vercel AI, MCP, and any custom tool‑calling loop.

Contributing & community

Issues & feature ideas – Open a GitHub issue.
Contract contributions – Add new YAML bundles or patterns; the repo encourages community‑driven incident‑specific contracts.
Discussion – Discord, X (formerly Twitter), and LinkedIn links are provided in the README.

License

Apache 2.0 – free for commercial and non‑commercial use.

Bottom line: Sponsio gives you deterministic, sub‑millisecond safety checks for LLM agents, letting you enforce policies that would otherwise require slow, probabilistic LLM‑based guards. It works out‑of‑the‑box with popular agent frameworks and can be extended with custom contracts for any domain.