some file

MCP & Middleware Integrations

These plug into whatever extension point the specific tool already exposes, rather than a shared mechanism.

See Custom Agents first if you haven't installed the SDK or called start() yet.

LiteLLM

from netzilo.litellm import govern, handler
import litellm

govern()
litellm.callbacks = [handler()]

litellm.completion(model="gpt-4o", messages=[{"role": "user", "content": "..."}])

This layer is block (best-effort) + observe, not redact: raising in the pre-call hook aborts the call on most LiteLLM versions/paths, but LiteLLM's CustomLogger has no documented content-replacement channel, so a redact verdict is logged rather than applied.

MCP

from netzilo.mcp_client import govern, govern_session
from mcp import ClientSession

govern()
session = govern_session(ClientSession(read_stream, write_stream))

result = await session.call_tool("get_order_status", {"order_id": "..."})

A blocked call raises NetziloBlockedError; text content in a redacted result is replaced in place before the agent consumes it. This covers calls made through the session's call_tool() method — a client that caches a reference to it before govern_session() runs bypasses the patch.

Guardrails AI

from guardrails import Guard
from netzilo.guardrails import govern, validator

govern()
guard = Guard().use(validator(on_fail="fix"))

result = guard.validate(user_input)   # result.validated_output is sanitized

validator() composes with a Guard's own on_fail pipeline ("exception", "filter", "fix", ...) instead of needing its own call site.