Agent Frameworks & Runtime

The tools on this page are the ones you actually build agents with. You do not need all of them. You need enough of them to build something real, break it deliberately, and then argue about the design with evidence in hand.

Read this page as a security engineer, not as an application developer. For each framework the question is not “how fast can I ship a chatbot” but “where does untrusted text enter, where does a tool call leave, and what did the runtime record about it.”

LangGraph

• Link: https://github.com/langchain-ai/langgraph
• What it is: A library for building stateful, graph-structured agent workflows on top of LangChain. Nodes are steps, edges are transitions, and the graph state is explicit rather than hidden in a prompt loop.
• Install: pip install langgraph
• Why it matters for security: Because the control flow is a declared graph, you can point at the exact node where an untrusted document enters and the exact edge that leads to a privileged tool. Implicit agent loops make that argument impossible; a graph makes it reviewable.

CrewAI

• Link: https://github.com/crewAIInc/crewAI
• What it is: A framework for multi-agent systems built around roles, goals, and task delegation between agents.
• Install: pip install crewai
• Why it matters for security: Role-based delegation is exactly where confused-deputy problems appear. One agent’s output becomes another agent’s instructions, so a prompt injection landing in a low-privilege researcher agent can be laundered into a high-privilege executor agent. Build one, then try that attack yourself.

AutoGen

• Link: https://github.com/microsoft/autogen
• What it is: Microsoft’s framework for multi-agent conversation, where agents (and optionally humans) exchange messages to solve a task, with support for code-executing agents.
• Install: pip install autogen-agentchat (package naming has changed across major versions; check the repository README for the version you want)
• Why it matters for security: Code-executing agents are the sharpest edge in the whole field. AutoGen makes it easy to give a model a Python interpreter, which is the single best reason to learn container isolation, network egress rules, and filesystem scoping before you demo anything.

Model Context Protocol (MCP)

• Link: https://modelcontextprotocol.io
• What it is: An open protocol that standardizes how applications expose tools, resources, and prompts to LLMs. The specification and documentation live at the site above; the reference implementations are maintained on GitHub.
• Install: Python SDK with pip install mcp; TypeScript SDK with npm install @modelcontextprotocol/sdk
• Why it matters for security: MCP centralizes tool exposure, which makes it the natural place to enforce authorization. A single server decides which tools exist, what arguments they accept, and what identity they act as. That same centralization is why a malicious or compromised MCP server is such a high-value target: it sits between the model and every capability it has.

MCP Python SDK

• Link: https://github.com/modelcontextprotocol/python-sdk
• What it is: The official Python implementation for writing MCP servers and clients.
• Install: pip install mcp
• Why it matters for security: Writing your own MCP server is the fastest way to internalize the authorization gap. You will notice immediately that the protocol tells you what was requested but says nothing about who is allowed to request it. That gap is your job.

MCP TypeScript SDK

• Link: https://github.com/modelcontextprotocol/typescript-sdk
• What it is: The official TypeScript/JavaScript implementation of MCP for servers and clients.
• Install: npm install @modelcontextprotocol/sdk
• Why it matters for security: Most desktop and IDE-embedded MCP servers are written in TypeScript. If you want to review the servers your organization’s developers are already running, you need to be able to read this code.

Anthropic Python SDK

• Link: https://github.com/anthropics/anthropic-sdk-python
• What it is: The official Python client for the Anthropic API, including message creation, streaming, and tool use.
• Install: pip install anthropic
• Why it matters for security: Working at the raw SDK level shows you the actual request and response payloads that frameworks hide. When you are debugging why an agent called a tool it should not have, the tool-use blocks in the raw message are the ground truth.

LlamaIndex

• Link: https://github.com/run-llama/llama_index
• What it is: A data framework for connecting LLMs to external data: ingestion, chunking, indexing, and retrieval pipelines.
• Install: pip install llama-index
• Why it matters for security: Retrieval pipelines are an injection surface with a long fuse. A poisoned document ingested today fires whenever it is retrieved months later. Knowing how chunking and metadata work is what lets you trace a bad answer back to the document that caused it.

Ollama

• Link: https://ollama.com
• What it is: A tool for running open-weight models locally with a simple CLI and a local HTTP API.
• Install: Download the installer for macOS, Windows, or Linux from the official site, or use the Linux install script documented there. Pull models with ollama pull.
• Why it matters for security: Local inference is the architectural answer when data must not leave a boundary. When a regulated business unit says the prompts cannot go to a third party, “run the model inside the boundary” is a real design, and you should have run it at least once before proposing it.

vLLM

• Link: https://github.com/vllm-project/vllm
• What it is: A high-throughput inference and serving engine for LLMs, with an OpenAI-compatible HTTP server.
• Install: pip install vllm
• Why it matters for security: vLLM is what a self-hosted production inference tier usually looks like. That means it is also an internal service you will be asked to threat model: who can reach the endpoint, is there authentication in front of it, and what gets logged about each request.

pgvector

• Link: https://github.com/pgvector/pgvector
• What it is: A PostgreSQL extension that adds vector similarity search to a normal relational database.
• Install: Install as a PostgreSQL extension (packages, Docker images, or from source), then enable it with CREATE EXTENSION vector;
• Why it matters for security: Vector store choice determines whether you can attribute a retrieved chunk to a source. With pgvector the embeddings live next to ordinary relational columns, so document ownership, tenant IDs, and access labels can be enforced with row-level security you already know how to audit.

Weaviate

• Link: https://github.com/weaviate/weaviate
• What it is: An open-source vector database with a schema model, hybrid search, and built-in multi-tenancy.
• Install: Run via Docker or Kubernetes per the official documentation; the Python client installs with pip install weaviate-client
• Why it matters for security: Its multi-tenancy model is worth studying specifically because tenant isolation in retrieval is a real and frequently botched control. Cross-tenant retrieval leakage is a data breach that looks like a helpful answer.

Chroma

• Link: https://github.com/chroma-core/chroma
• What it is: An embedded, developer-friendly vector database that runs in-process or as a server.
• Install: pip install chromadb
• Why it matters for security: Chroma is the right choice for labs precisely because it is trivial to stand up and to wipe. Use it to reproduce a retrieval-poisoning scenario locally before you argue about controls for a production store.

Where this goes next

Build with these in the labs, then attack what you built. Lab 2 exercises MCP and multi-agent delegation; Lab 3 attacks the result using the tooling on the red team page; Lab 4 instruments it with the observability stack. Return to the tools index for the full set.