← Frameworks

模型与开放条件Model & openness

官方自述 model-agnostic，README 列为四条原则之一。

官方原文： "Model-agnostic — works with any LLM that supports tool calling: frontier, open-weight, or local"

FAQ 进一步说明：任何支持 tool calling 的模型都行。包括：

• frontier API（OpenAI / Anthropic / Google）
• provider 托管的开源权重（Baseten / Fireworks）
• 通过 Ollama / vLLM / llama.cpp 自托管的模型

接入方式是任一 LangChain chat model。换 provider 不需要改 agent 代码。

Officially self-described as model-agnostic, listed as one of four principles in the README.

Official wording: "Model-agnostic — works with any LLM that supports tool calling: frontier, open-weight, or local"

The FAQ elaborates: any model supporting tool calling works. Including:

• frontier APIs (OpenAI / Anthropic / Google)
• provider-hosted open weights (Baseten / Fireworks)
• models self-hosted via Ollama / vLLM / llama.cpp

The integration path is any LangChain chat model. Switching providers requires no agent-code changes.

运行位置Where it runs

它是库，不是服务 —— 进程由你自己运营。

README 明确 built on LangGraph（streaming, persistence, checkpointing）。 另可配 LangSmith 做 tracing/evaluation/deployment。

agent loop 的责任分布：

• 模型决策与工具调用在 LangGraph runtime 上
• Deep Agents 预置了规划、上下文管理、子代理委派

It is a library, not a service — you operate the process yourself.

The README states it is built on LangGraph (streaming, persistence, checkpointing). LangSmith can additionally be configured for tracing/evaluation/deployment.

Responsibility split of the agent loop:

• model decisions and tool calls run on the LangGraph runtime
• Deep Agents presets planning, context management, sub-agent delegation

本地文件Local files

Filesystem 能力是核心卖点：read / write / edit / search。

它的后端可插拔（pluggable local, sandboxed, or remote backends）。 官方另设独立 Sandboxes 页，讲隔离执行环境与 execute 工具 （SandboxBackendProtocolV2，仅 sandbox 后端暴露 shell）。

重要边界：官方安全声明原文说 「Enforce boundaries at the tool/sandbox level, not by expecting the model to self-police」。

即官方明确不提供一层权限护栏，边界要靠你自己在 tool/sandbox 层实现。

官方未说明：多 agent 并发写同一文件的冲突处理（已查 overview / backends 页）。

Filesystem capability is the core selling point: read / write / edit / search.

Its backends are pluggable (pluggable local, sandboxed, or remote backends). The official docs also have a standalone Sandboxes page covering isolated execution environments and the execute tool (SandboxBackendProtocolV2; only sandbox backends expose a shell).

Important boundary: the official security statement says verbatim "Enforce boundaries at the tool/sandbox level, not by expecting the model to self-police".

That is, the official docs explicitly do not provide a permission-guardrail layer; boundaries must be implemented by you at the tool/sandbox layer.

Not stated officially: conflict handling when multiple agents concurrently write the same file (overview / backends pages checked).

关机后的任务Tasks after shutdown

自托管 = 关了就停，没有托管执行选项（README 无相关承诺）。

但断点续跑有官方支撑：

• built on LangGraph 的 persistence + checkpointing
• persistent memory（pluggable state and store backends for cross-session recall）

官方另有 LangSmith 提供 deployment。

Self-hosted = stops when stopped, no hosted execution option (the README makes no such promise).

But resume-after-crash has official support:

• built on LangGraph's persistence + checkpointing
• persistent memory (pluggable state and store backends for cross-session recall)

LangSmith separately provides deployment officially.

工具与扩展Tools & extensions

工具链是 "batteries-included" 定位。 官方列出的能力：

• Sub-agents —— 隔离子上下文的委派
• Filesystem
• Shell access（run commands in your sandbox of choice）
• Skills —— 按需加载的可复用行为
• Tools —— 自带函数或任意 MCP server

MCP 支持明确：官方列「bring your own functions or any MCP server」。

human-in-the-loop：可 approve / edit / reject 工具调用，发生在执行前。

The toolchain is positioned "batteries-included." Officially listed capabilities:

• Sub-agents — delegation with isolated sub-contexts
• Filesystem
• Shell access (run commands in your sandbox of choice)
• Skills — reusable behaviors loaded on demand
• Tools — your own functions or any MCP server

MCP support is explicit: the official docs list "bring your own functions or any MCP server".

Human-in-the-loop: tool calls can be approved / edited / rejected, happening before execution.

上下文与记忆Context & memory

本分区"状态 ≠ 上下文"分野的教科书案例。

• Context management = summarize long threads and offload tool outputs to disk（卸载，不是丢）
• Persistent memory = pluggable state and store backends，支持跨会话召回

官方描述 defaults are tuned for long-horizon, multi-step work。

两种做法并存：压缩历史 + 把大工具输出落盘 + 跨会话记忆。

The textbook case of this track's "state ≠ context" distinction.

• Context management = summarize long threads and offload tool outputs to disk (offloading, not discarding)
• Persistent memory = pluggable state and store backends, supporting cross-session recall

The official description: defaults are tuned for long-horizon, multi-step work.

Two practices coexist: compressing history + landing large tool outputs on disk + cross-session memory.

权限与限制Permissions & limits

官方明确不设防模型越界。 Security 章节原文：

官方原文（三句连引）："Deep Agents follows a "trust the LLM" model." "The agent can do anything its tools allow." "Enforce boundaries at the tool/sandbox level, not by expecting the model to self-police."

翻译：采用「信任 LLM」模型，Agent 能做任何它的工具允许的事。 边界要在工具/沙箱层强制，不要指望模型自我约束。

唯一的内建人工干预点是这个。

human-in-the-loop 的工具调用审批（approve/edit/reject）。

这意味着：装了 Deep Agents 之后，权限模型是你的责任。

The official docs explicitly do not defend against model overreach. Security section wording:

Official wording (three sentences quoted together): "Deep Agents follows a "trust the LLM" model." "The agent can do anything its tools allow." "Enforce boundaries at the tool/sandbox level, not by expecting the model to self-police."

Meaning: it follows a "trust the LLM" model; the agent can do anything its tools allow. Boundaries must be enforced at the tool/sandbox layer — do not expect the model to self-restrain.

The only built-in human intervention point is this:

human-in-the-loop tool-call approval (approve/edit/reject).

This means: after installing Deep Agents, the permission model is your responsibility.

适合什么任务Best for

适合三类场景。

要一个开箱即用、默认调优好、面向长任务多步流程的通用 Agent。 不想自己拼 filesystem / 记忆 / 子代理。已经在 LangChain 生态里。

不适合三类场景。

需要细粒度权限护栏 —— 官方明说不提供，必须自建沙箱。 要严格控制 agent loop 形状 —— 该用 LangGraph 自定义图。 想要轻量 harness —— 该用 LangChain create_agent。

Fits three scenarios.

Wanting an out-of-the-box, well-tuned-by-default general Agent for long-horizon multi-step flows. Not wanting to assemble filesystem / memory / sub-agents yourself. Already in the LangChain ecosystem.

Does not fit three scenarios.

Needing fine-grained permission guardrails — the official docs say they do not provide them; you must build your own sandbox. Wanting strict control of the agent loop shape — use LangGraph custom graphs. Wanting a lightweight harness — use LangChain create_agent.

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.