Research

Findings from building Tulip — an open-source Python agent framework — and the control layer that decides which of an agent's actions may run. Everything here comes from running code against real catalogs, real tools and real models. The method and the scoring code are public and runnable against your own endpoint; where a result depends on a model or a corpus we do not redistribute, the page says so, and where a result is a single illustration rather than a benchmark, it says that too.

Papers

GSAR: Typed Grounding for Hallucination Detection and Recovery in Multi-Agent LLMs — 2026. Uses a judge to partition claims into grounded / ungrounded / contradicted / complementary against typed evidence, scores the partition, and routes the result to proceed, regenerate, replan or abstain. Evaluated with multiple LLM judges on FEVER.

Implemented in the SDK as GSAR; ground_finding() returns evidence or an abstention, so an ungrounded claim is not something the caller can accidentally ship.

Findings

The family of harm your agent policy cannot see — a risk policy tends to encode one family of consequence and stay silent about the others, and the silence survives code review, its own tests, validation against the real tool catalog, and training.

Three independent instances, one of them measured: Clusiana-Admit-4B on 3,139 distinct held-out items reaches a 1.88% false-allow rate. Row-weighted across the 8,989-row split, those errors cluster by family — 5.45% on execution and 5.32% on egress against 0.00% on destruction. Includes a seven-model comparison against GPT-5 and Claude Opus/Sonnet/Haiku on identical rows, and the reason the headline number from that comparison is misleading.