← How it works

framework harness

Agentic Frameworks

VisIQ ships a harness for the frameworks and coding agents that agents are actually built on. Custom agents: LangChain, Vercel AI SDK, Mastra, OpenAI Agents SDK, LlamaIndex, VoltAgent, and Semantic Kernel. Coding agents, governed inline in the CLI: Claude Code, Cursor, OpenClaw, Codex, GitHub Copilot, Cline, and OpenCode. One call where the agent is constructed puts every tool call and every retrieval in front of policy before execution.

The install

A couple of lines.Governed.

VisIQ installs inside the agent you already have. Pick your framework and language, or wire a CLI agent from the terminal, and watch the status flip.

agent.ts○ UNGOVERNED

import { AgentExecutor, createOpenAIToolsAgent } from "langchain/agents";
import { ChatOpenAI } from "@langchain/openai";

const llm = new ChatOpenAI({ model: "gpt-4o" });
const agent = await createOpenAIToolsAgent({ llm, tools, prompt });

const executor = new AgentExecutor({ agent, tools });
const result = await executor.invoke({ input: "What was Q3 revenue?" });
This agent runs ungoverned. Any tool call executes unchecked.

One line where the agent is built

For LangChain, Vercel AI SDK, Mastra, OpenAI Agents SDK, LlamaIndex.TS, and VoltAgent, governance is a wrapper: call visiq() once on the executor at construction time and the harness instruments the agent's tools and retrievers in place. For OpenClaw it is a native plugin that registers hooks on the daemon and covers built-in and MCP-loaded tools through the same seam. Semantic Kernel and the other coding agents (Claude Code, Cursor, Codex, GitHub Copilot, Cline, and OpenCode) each have their own harness, listed in the documentation.

There is no proxy to route through and no rewrite of the agent. The framework keeps doing what it does; the harness sits on the seams the framework already exposes.

What the harness intercepts

Every tool call is observed with its full arguments before it executes, and a deny stops it there, pre-execution, with hard-stop semantics. Sensitive actions can route to a human instead of resolving automatically.

Every retrieval is intercepted between the source and the model. Policy can drop a document entirely or rewrite it to mask secrets and personal identifiers, and the masked version is what enters the model's context.

Decisions are local

The harness evaluates in-process against one locally cached rule bundle, refreshed in the background. Receipts are signed off the decision path, so a decision's latency is identical with receipts on or off.

The only decision that waits on the network is the one that should: a human approval.

Failure is a mode you choose

A blocked call does not crash the agent. The harness returns the denial as a structured tool result, so the agent reads it and reasons over it on its next turn.

If the harness itself cannot evaluate, agent-side behavior defaults to fail-open with loud telemetry, and teams that want the stricter posture opt into fail-closed. A policy deny enforces in either mode. The per-framework capability grid, with what each harness observes, blocks, and redacts, is published on the agent security matrix.