> ## Documentation Index
> Fetch the complete documentation index at: https://docs.declaw.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenAI Agents SDK — overview

> Runnable recipes for agents executing inside declaw microVMs via the openai-agents sandbox backend.

## What this section covers

End-to-end examples that wire the OpenAI Agents SDK up to a declaw
sandbox with `pip install "declaw[openai-agents]"`. Every bash, file, and
PTY tool call the agent makes is dispatched through a declaw microVM
with the platform's full security posture applied at the network
edge — PII redaction, prompt-injection detection, per-sandbox domain
allowlists, audit logging, env-var masking.

## Install

```bash theme={null}
pip install "declaw[openai-agents]"
```

## Credentials

```bash theme={null}
export DECLAW_API_KEY=dcl_...
export DECLAW_DOMAIN=api.declaw.ai
export OPENAI_API_KEY=sk-...
```

## Import surface

Every declaw knob — sandbox config, security policy, network policy,
lifecycle — is re-exported from `declaw.openai` so recipes import
from a single place:

```python theme={null}
from declaw.openai import (
    DeclawSandboxClient,
    DeclawSandboxClientOptions,
    SecurityPolicy,
    PIIConfig,
    InjectionDefenseConfig,
    ToxicityConfig,
    CodeSecurityConfig,
    InvisibleTextConfig,
    NetworkPolicy,
    TransformationRule,
    SandboxLifecycle,
    SandboxNetworkOpts,
    # Volumes: upload a tarball once, attach to one or many agent sandboxes.
    AsyncVolumes,
    Volumes,
    VolumeAttachment,
)
```

## Template coverage

| Recipe                                                    | Template           | What it shows                                                                                     |
| --------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------- |
| [Data analyst](./data-analyst)                            | `python`           | pandas + matplotlib + PII rehydration                                                             |
| [Code reviewer](./code-reviewer)                          | `ai-agent`         | git clone, ruff, structured output, env-driven config                                             |
| [Customer support](./customer-support)                    | `base`             | Multi-agent handoffs, PII redact + rehydrate                                                      |
| [Web scraper](./web-scraper)                              | `python`           | Single-host network allowlist, BeautifulSoup                                                      |
| [TypeScript API](./typescript-api)                        | `node`             | Background server, curl, compile + run                                                            |
| [DevOps audit](./devops-audit)                            | `devops`           | Static checks, transformation rules, hadolint                                                     |
| [ML training](./ml-model)                                 | `code-interpreter` | scikit-learn + matplotlib, zero-install                                                           |
| [Custom transformations](./transformations)               | `python`           | End-to-end proof of regex-based directional rewrites at the edge proxy                            |
| [Shared volume, multi-agent](./shared-volume-multi-agent) | `python`           | Upload a dataset once as a declaw volume, fan out GPT-4.1 agents that each analyze it in parallel |

## Two layers of isolation every recipe relies on

1. **Filesystem isolation**: every sandbox boots with a fresh
   `/workspace` overlay. Artifacts an agent writes (reports, logs,
   compiled binaries, trained models) disappear when the sandbox
   terminates. No host bleed-through, no scratch cleanup to manage.
2. **Environment isolation**: `envs={...}` pushes key/value pairs
   into the microVM as real process env vars. The agent reads them
   with `printenv` — they never need to appear in the prompt, so
   secrets stay out of the LLM trace.

Plus the security posture enforced at the VM's edge proxy:

* `PIIConfig(rehydrate_response=True)` — redact PII on the way out,
  restore it on the way back in, so the agent code works unchanged
  while the upstream model never sees real PII.
* `NetworkPolicy(allow_out=[...])` — default-deny outbound; only the
  listed hosts reach the internet.
* `InjectionDefenseConfig(enabled=True, domains=["api.openai.com"])` —
  flag prompt-injection attempts in HTTP bodies before they hit the
  upstream LLM. Scanning is per-domain: only requests to hosts listed
  in `domains` are scanned, so name the LLM host there.
* `TransformationRule(match=..., replace=...)` — directional regex
  rewrites, e.g. redact AWS keys before they leave the VM.

## Getting started

Start with the [quickstart](./quickstart). Once that runs cleanly,
any recipe above is a drop-in copy — each script is self-contained
and under 150 lines.