Framework guide · CrewAI

CrewAI under Aarmos in 60 seconds.

The CLI is not publicly distributed. Commands on this page are reference examples, not instructions you can run today.

Keep your existing CrewAI crew exactly as-is. No aarmos import, no framework wrapper, no monkey-patch. Environment variables route outbound HTTP calls that honor proxy settings through the local aarmos proxy, where each call is decided against your outbound policy and recorded in a hash-chained local evidence log. Outbound requests are not restricted until an egress allowlist is in effect — confirm a refusal before you rely on it.

Runnable example: examples/crewai/ in the repo. Mirrored below.

0 · Sanity-check your environment

aarmos doctor

Verifies daemon reachability, proxy env, LLM keys, and that the workspace has a valid policy bundle.

1 · Start the daemon

aarmos daemon
▸ listening on 127.0.0.1:7681
▸ policy: ./aarmos.json

2 · Your existing CrewAI crew — unchanged

# src/agent.py — stock CrewAI. No aarmos imports.
from crewai import Agent, Task, Crew

researcher = Agent(role="Researcher", goal="Answer briefly.",
                   backstory="You explain in one sentence.",
                   allow_delegation=False)
task = Task(description="What is a receipt?",
            expected_output="One sentence.", agent=researcher)
print(Crew(agents=[researcher], tasks=[task]).kickoff())

3 · Run it under Aarmos

aarmos proxy &                 # start the local runtime (mints a session)
eval "$(aarmos env)"           # authenticated HTTPS_PROXY + HTTP_PROXY
python src/agent.py

▸ gate: api.openai.com  (verb: communicate)  ✓ allowed by egress allowlist
▸ evidence: .aarmos/avar/…  (hash-chained record)

4 · Export and verify the evidence

aarmos keys init                                  # once: local evidence-signing key
aarmos incident export --last 24h --out ev.aarmos
aarmos verify ev.aarmos --trusted-signer sha256:…  # your key's fingerprint
  signer trust: established against your supplied trusted signer sha256:…
  signature scope: export-time packaging only — not event-time signing or approval

Individual call records are hash-chained, not signed. The signature is applied when you export evidence; verification checks it against the signer you trust and refuses altered records.

To review calls before you export, run aarmos activity on the same machine — it lists recent calls from the local evidence log as authorized or denied, with the rule that decided each one. Proxied calls stay on your machine: they do not appear in the web app's audit page, which lists only runs made inside the web app. The exported file is the evidence you verify and share.

5 · Who spawned whom (optional)

A crew is not one agent. The proxy sees the calls a worker makes; it cannot see that the manager spawned that worker — CrewAI keeps that in process memory. The adapter declares each spawn as it happens, so evidence can answer which step of which crew made the call.

# optional — attribution only, never enforcement
from aarmos_crewai import govern

crew = Crew(agents=[researcher], tasks=[task])
govern(crew, invocation_id="nightly-close-2026-08-10")
crew.kickoff()

aarmos lineage show nightly-close-2026-08-10
✓ crewai-manager [agent] — declared by the crewai adapter at spawn time
  ✓ Researcher [subagent] — declared by the crewai adapter at spawn time

Without the adapter, actors seen in the same run and process may be correlated for readability — shown as a guess, and excluded from the --attributed view an export or receipt uses. Declared edges are attribution; correlation never quietly becomes one.

Why no CA certificate?

The proxy tunnels HTTPS by hostname and never decrypts it, so your existing certificate chain is untouched — no root CA to install, noREQUESTS_CA_BUNDLE or SSL_CERT_FILE to set. The trade-off: proxied calls are decided and recorded at hostname level. Installing an adapter does not by itself enforce rules on arguments; argument-level decisions apply only to tool calls routed through a reviewed tool binding on a supported enforcing path.

Honest limits

CrewAI tools that shell out to native binaries bypass the proxy — declare them as connectors instead of trusting env vars.
Local function-tools (pure Python callables) do not touch the network and are not gated by this path.
Streaming responses hash on close; a truncated stream is recorded as truncated.

Interception runs on your device. Tamper-evident, not tamper-resistant against a modified build — see the threat model.

LangChain guide → · AutoGen guide → · AVAR spec