cpex

What it is and what it does

CPEX is a plugin framework designed to add policy enforcement, security, observability, and governance to AI agents and toolchains without embedding that logic into application code. It works by defining named hook points in your application (e.g., before/after tool invocation, prompt fetching, agent execution), then registering plugins that attach to those hooks and run automatically when triggered. Plugins can allow, block, or modify payloads; they execute in ordered phases (sequential, transform, audit, concurrent, fire-and-forget) to support different enforcement and observability patterns.

The framework comes with built-in hooks for common AI operations (tool_pre_invoke, tool_post_invoke, prompt_pre_fetch, etc.) and lets you define custom hooks with your own payload types. It handles plugin registration, ordering, timeouts, and error isolation automatically. With 14 runtime dependencies including fastapi, pydantic, prometheus-client, and rich, it's designed for production agent systems that need structured policy pipelines and observability.

Use it for:

• Enforce access control and rate limiting on tool calls in multi-agent systems without modifying agent code.
• Detect and block prompt injection attempts or policy violations at hook points before operations execute.
• Collect audit logs, request tracing, and metrics on agent operations through observe-only audit plugins.
• Implement data loss prevention by transforming or redacting sensitive data in payloads before they leave the system.
• Build approval workflows or compliance validation gates that run automatically at critical agent operations.
• Add circuit breakers and response validation to agent tool invocations without changing core agent logic.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

CPEX is a plugin framework that lets you intercept and enforce policies on AI agent operations through composable hooks and plugins, without modifying core application logic.

Yes, if you are building AI agents or toolchains that need policy enforcement, security, or governance without tight coupling to application logic. The framework is actively maintained, has no known vulnerabilities, and uses a permissive license. However, it is early-stage (0.1.3, released 2026-03-05) with 12 GitHub stars—evaluate stability and API maturity for your use case before committing to production.

Install

cpex on PyPI

pip install cpex

uv add cpex

poetry add cpex

Installing cpex

Before you install

Low friction: pure Python wheel with no compiled dependencies. Active maintenance—last commit 2026-08-14, first release 2026-03-05. Fourteen runtime dependencies (fastapi, httpx, pydantic, prometheus-client, etc.) add moderate weight but are all standard, well-maintained packages.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; you must include a copy of the license and note any modifications.

Quickstart

pip install cpex

from cpex.framework import hook, Plugin, PluginResult

class MyPlugin(Plugin):
    @hook("tool_pre_invoke")
    async def enforce_policy(self, payload, context):
        return PluginResult(continue_processing=True)

Requires Python 3.11 or later.

Verify before relying

• Whether the 14 runtime dependencies (particularly fastapi, prometheus-client, pygithub) are all required at import time or only for specific features.
• Production readiness and stability guarantees given the 0.1.3 version and early release date (2026-03-05).
• Performance characteristics and overhead of the plugin pipeline under high-concurrency agent workloads.

Package facts

Evidence: cpex-0.1.3-py3-none-any.whl

Tags

More Python Modules packages

Further reading