DeepKeep AI Firewall Guardrails

Use DeepKeep AI Firewall as custom guardrails for Agno Agents. DeepKeep runs before user input reaches the model and after model output is generated.

deepkeep_ai_firewall.py

"""
DeepKeep AI Firewall Guardrails
===============================

This example shows how to use DeepKeep AI Firewall as custom guardrails for
Agno Agents. DeepKeep runs before user input reaches the model and after model
output is generated.

Requirements:
- pip install agno-deepkeep
- DEEPKEEP_API_KEY and DEEPKEEP_BASE_URL set

Set credentials before running:

    export DEEPKEEP_API_KEY="dk_..."
    export DEEPKEEP_BASE_URL="https://api.example.deepkeep.ai"

Usage:
    python cookbook/02_agents/08_guardrails/deepkeep_ai_firewall.py
"""

from agno.agent import Agent
from agno.models.openai import OpenAIResponses
from agno_deepkeep import DeepKeepGuardrail

agent = Agent(
    name="DeepKeep Protected Agent",
    model=OpenAIResponses(id="gpt-5.2"),
    instructions="Answer user questions safely and concisely.",
    pre_hooks=[
        DeepKeepGuardrail(
            pre_model="input-firewall-id",
        )
    ],
    post_hooks=[
        DeepKeepGuardrail(
            post_model="output-firewall-id",
        )
    ],
    markdown=True,
)

if __name__ == "__main__":
    agent.print_response("Explain how to store API keys securely.")

Guardrail InputCheckError and OutputCheckError become failed run outputs. They are not caught by the source's try/except around print_response() or aprint_response(). Use run() or arun() and check the returned status before displaying content or declaring success.

Add this helper after your imports:

from agno.run import RunStatus

def show_checked_response(response) -> None:
    if response.status != RunStatus.completed:
        print(f"Run rejected or failed ({response.status.value}).")
        return
    print(response.content)

A generic failed status can also indicate a provider error. Nonstream run outputs do not expose a check_trigger field. Output rejected by a post-hook can remain in the run record; this helper withholds it from the display. Streaming content may already have been emitted before the post-hook runs.

Check output before displaying it

Add the helper above and replace the original if __name__ == "__main__" block with:

if __name__ == "__main__":
    show_checked_response(agent.run('Explain how to store API keys securely.'))

This checks the final status before displaying the answer. It does not retract streamed content or erase rejected content from stored runs.

Run the Example

Set up your virtual environment

uv venv --python 3.12
source .venv/bin/activate

Install dependencies

uv pip install -U agno agno-deepkeep openai

Export your OpenAI API key

export OPENAI_API_KEY="your_openai_api_key_here"

Configure DeepKeep

Obtain an API key, base URL, and input/output firewall model IDs from your DeepKeep deployment. Replace input-firewall-id and output-firewall-id in the agent configuration with those issued IDs.

export DEEPKEEP_API_KEY="your_deepkeep_api_key"
export DEEPKEEP_BASE_URL="https://your-deepkeep-deployment"

The URLs above are placeholders. This integration sends input and generated output to DeepKeep. The documented constructor is supported by agno-deepkeep 0.1.1.

Apply the current checks

Add the status helper and apply the replacements described above. Keep the original imports and agent definitions that the replacement uses.

Run the example

Save the adapted code as deepkeep_ai_firewall.py, then run:

python deepkeep_ai_firewall.py

Full source: cookbook/02_agents/08_guardrails/deepkeep_ai_firewall.py