English · <a href="./README.zh-CN.md">简体中文</a> · <a href="./README.ja.md">日本語</a>

Sponsio

<img src="https://raw.githubusercontent.com/SponsioLabs/Sponsio/main/assets/sponsio-comparison-freeze.png" alt="Same coding agent under a declared code freeze. Without Sponsio it drops the prod users table, back-fills fabricated rows, and files a status report that hides the damage. With Sponsio the first destructive SQL is blocked pre-execution: 35 checks, 100% deterministic, 0 LLM calls, p50 13µs." width="900"> Sponsio provides deterministic contracts for agent procedures over time, enforced in under 0.01 ms with zero LLM cost at runtime. Works with LangChain, Claude Agent, OpenAI Agents, Google ADK, CrewAI, Vercel AI, MCP, or any custom tool-calling loop, in Python or TypeScript.

An agent contract is a runtime rule that is checked at every agent action, backed by formal methods.

v0.2.0a3 alpha is out. pip install --pre sponsio==0.2.0a3. Closes a redirect_to_safe fail-open bug in non-LangGraph adapters (the unsafe call was running anyway), brings TS Eq semantics to Python parity for composite values, and adds Cloudflare Workers compatibility. Upgrade recommended if you are on 0.2.0a2. See the v0.2.0a3 release notes.

How Sponsio works

On ODCV-Bench (12 frontier LLMs × 80 trajectories), unguarded models cheat in 11.5%–66.7% of runs. With Sponsio, 95.6% of misalignment is avoided on average; 24/36 high-risk scenarios at 100%. On the Financial-Audit-Fraud-Finding scenario, frontier models commit fraud in 16/24 trials; Sponsio blocks 18/19. On RedCode-Exec (1,410 cases), Sponsio reaches 92% combined (bash 95% · python 90%) across a 60-file clean-code audit.

The logic checker takes p50 0.139 ms per contract, 5,000×–60,000× faster than any LLM-as-judge guardrail (50–800 ms per check), with zero LLM cost in the hot path. p99 stays under 1.04 ms across every measured workload.

See the full benchmark methodology and per-model breakdown, how Sponsio compares against prompt filters, output validators, LLM-as-judge, and sandboxing, or dive into the architecture and formal methods primer.

Quick start

A single prompt or a 2-line CLI command gets you onboarded.

Paste into Claude Code / Codex / Cursor. The agent walks the full onboarding flow:

Or run the CLI yourself:

bash
pip install sponsio        # or: npm install -D @sponsio/sdk
sponsio init .             # interactive wizard: detects framework, IDE hosts, observe vs enforce

The wizard auto-detects your framework and prints the right wrap snippet. For manual wiring, see all supported integrations. OpenClaw users get bundled ClawHavoc and CVE-2026-25253 coverage out of the box. For config reference, observe → enforce flip, and CI wiring, see the full walkthrough.

Drafting contracts from natural language. sponsio validate "<rule in plain English>" turns a plain-English rule into a contract you can read back. Treat the output as a starting draft to review and adjust before you enforce. The determinism is in how contracts are enforced at runtime, not in how they're drafted.

Contract Library

Sixteen contract bundles ship out of the box, organized by tier (always-on / per-tool / per-incident). Each bundle is a YAML pack composed from Sponsio's deterministic patterns. Drop one into sponsio.yaml and your agent is guarded against a known failure class in one line, with no per-contract authoring.

yaml
# sponsio.yaml: one-line bundle inclusion
agents:
  my_agent:
    workspace: "/srv/my-bot"
    include:
      - sponsio:core/universal        # always-on
      - sponsio:capability/shell      # if your agent runs commands
      - sponsio:capability/filesystem # if your agent touches files

See the full bundle reference for all 16 bundles, or the 46 underlying patterns for the primitives they compose. Want a bundle for your agent type? That is currently the highest-leverage way to contribute. Open an issue with your incident, CVE, or pattern.

Contributing

Patches, issue reports, and new pattern proposals are welcome. Start with CONTRIBUTING.md. Sponsio's threat model draws on public security research; e.g. Simon Willison's "Lethal Trifecta" shaped our multi-tool composition contracts. Have a threat model we should defend against? Open an issue.

License

Apache 2.0 (LICENSE).

AI agents reading this repo: llms.txt lists canonical doc paths; llms-full.txt is the concatenated full context dump.