Which agent frameworks Praesidia governs, and how far each recipe goes.
Every row below comes from our compatibility catalog, not from a sales slide. Each one names the framework, the state of its recipe, and the single path that recipe covers — because a framework logo on a vendor page tells you nothing about which of your agent's calls are actually under control.
If your framework is not on this page, it is not on this page. There is no second list.
Two states, and neither of them means "everything your framework does"
A recipe is a specific, versioned way of putting one framework's tool calls under Praesidia control. It is the unit we accept or do not accept — the framework as a whole is never the unit.
- Validated recipe
- The recipe passed an acceptance run with a separate human reviewer, distinct processes, and an independently verified receipt on the target it called. It is evidence about that path, at the versions we pinned.
- In validation
- Listed so you can prepare a workspace and evaluate it yourself. We have not completed an acceptance run for it, so treat compatibility as unproven until you have tested it against your own targets.
- What the recipe covers
- The catalog's own boundary sentence for that entry. Only the named path is governed. Unrelated native tools, other transports, and other versions of the framework sit outside the recipe and are not intercepted.
Every framework and client we have a recipe for
Each name links to the setup guide for that recipe. The same entries drive the integration catalog, with the pinned versions and the governed tool path for each.
| Framework | Languages | State | What the recipe covers | Setup guide |
|---|---|---|---|---|
| Agent frameworks and runtimesgoverned inside your runtime | ||||
| OpenClawNative managed tool, owner-context checks and strict before-tool blocking pass pinned plugin acceptance. | TypeScript | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| Hermes AgentPython managed HTTP tool is implemented with durable approval and exact-request recovery. | Python | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| ZeroClawAuthenticated instance management, durable delivery and a native restricted MCP tool profile are implemented. | Rust, Python | In validation | Official 0.8.4 management API was tested on Linux ARM64; native model/tool execution is outside that management profile. | Setup guide |
| NemoClaw / OpenShellA version-matched native tool gate and managed MCP recipe are implemented; full NVIDIA sandbox acceptance is pending. | — | In validation | NemoClaw is a deployment profile for separately integrated runtimes. Upstream alpha and platform restrictions apply. | Setup guide |
| LangGraph / LangChain / Deep AgentsPython managed HTTP tool is implemented with durable approval and exact-request recovery. | Python | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| CrewAIManaged tool passes functional fixtures; release is blocked by unresolved upstream Chroma dependency advisories. | Python | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| OpenAI Agents SDKSeparately versioned Python and TypeScript managed tools with native approval callbacks and durable restart handling. | Python, TypeScript | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| Google ADKPython managed HTTP tool is implemented with durable approval and exact-request recovery. | Python | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| Microsoft Agent FrameworkPython managed HTTP tool is implemented with durable approval and exact-request recovery. | Python, .NET | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| Agno AgentOSPython managed HTTP tool is implemented with durable approval and exact-request recovery. | Python | Validated recipe | Only the configured managed HTTP tool is covered; unrelated native tools, hosted tools and local memory are outside this profile. | Setup guide |
| Coding and low-code clientsgoverned through the managed companion | ||||
| OpenCodeOpenCode 1.18.29 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance. | Managed MCP companion | In validation | Only explicit tools on the configured Praesidia companion are governed; unrelated native tools remain outside this boundary. | Setup guide |
| Claude CodeClaude Code 2.1.202 authenticates and discovers the runnable managed MCP companion. Explicit prepare, owned checkpoint and approved resume pass transport and durable-restart acceptance. | Managed MCP companion | In validation | Only explicit tools on the configured Praesidia companion are governed; unrelated native tools remain outside this boundary. | Setup guide |
| n8nInstallable n8n node 0.1.0 executes authenticated managed MCP prepare, checkpoint and explicit approved resume against an independently signed inert target. | Managed MCP companion | In validation | Only explicit tools on the configured Praesidia companion are governed; unrelated native tools remain outside this boundary. | Setup guide |
| DifyThe installable tool plugin passes actual Dify Plugin SDK 0.10.2 loading and authenticated managed MCP prepare, checkpoint and approved resume. Official CLI 0.6.10 produces its local package. | Managed MCP companion | In validation | Only explicit tools on the configured Praesidia companion are governed; unrelated native tools remain outside this boundary. | Setup guide |
| LangflowThe runnable component passes actual lfx 1.12.0 invocation over authenticated managed MCP, including prepare, owned checkpoint and explicit approved resume with independent target-receipt verification. | Managed MCP companion | In validation | Only explicit tools on the configured Praesidia companion are governed; unrelated native tools remain outside this boundary. | Setup guide |
8 of 15 entries hold a validated recipe. Catalog reviewed 2026-09-07.
Frameworks we have no recipe for
These are asked about often enough that leaving them off the table silently would be misleading. We have no recipe for them, so there is nothing for you to evaluate and nothing for us to claim.
- Claude Agent SDK — no recipe in the catalog.
- AWS Bedrock Agents — no recipe in the catalog. Using a model hosted on a cloud provider is a separate question from governing an agent that framework runs.
- Microsoft Copilot Studio — no recipe in the catalog. Microsoft's entry in the table above is Agent Framework, which is a different product.
- AutoGen — no recipe in the catalog.
- Vercel AI SDK — no recipe in the catalog.
This list carries no date and no commitment. If one of these is what you run, tell us what you need governed — the useful thing for us is the exact call you want stopped, not the logo.
Start with the recipe for your framework
The setup guides are written against the same pinned versions we accepted, and they say plainly where each one stops.
Install the runtime
The installation guide covers the TypeScript and Python packages your deployment operator supplies, and is explicit that a local build is not a public release.
Govern a first tool call
The quickstart takes one registered agent and one protected target, then shows the allowed and blocked cases side by side.
Check the evidence
The evidence guide shows the record an action leaves behind and how to verify a signed export yourself.