CrewAI

Integrate Intutic governance with CrewAI multi-agent crews.

CrewAI is governed on two independent surfaces:

1. LLM egress — point the model client's base_url at the Intutic proxy (or launch under intutic exec).
2. Local tool execution — CrewAI tools run as plain callables/CrewStructuredTool instances inside your process. No config or hook file can gate them, so the blocking gate ships SDK-side in intutic-clawde.

How it works

The crewai adapter is detected when pyproject.toml, requirements.txt, or uv.lock declares a crewai dependency. It writes a .env.intutic file with proxy base-URL env vars plus a comment block pointing at the SDK gate.

Setup

1. Initialize Intutic

intutic init

2. Route LLM traffic through the proxy

Source .env.intutic, launch under intutic exec, or set base_url explicitly on your LLM client — same as LangGraph.

3. Gate local tool execution (SDK)

pip install intutic-clawde crewai

There is no intutic-clawde[crewai] extra: install crewai (1.15.3 or later) alongside the SDK.

Known transitive vulnerabilities (2026-08-19, updated 2026-10-21): crewai depends on chromadb (1.5.x in current crewai releases). Every chromadb release up to 1.5.9, the latest, carries four unpatched CVEs: CVE-2026-45829 (critical, pre-auth code injection), CVE-2026-45833 (critical, code injection via an authenticated UPDATE_COLLECTION call), CVE-2026-45830 (high, cross-tenant read/write) and CVE-2026-45831 (high, its role-based access control doesn't scope permissions to a tenant/database/collection). No patched chromadb release exists yet for any of them, so upgrading chromadb does not help. All four require reaching a running ChromaDB server's HTTP API (server mode, multi-tenant/auth model) — this integration never starts one, only the embedded PersistentClient. The chroma command chromadb installs (chroma run) does start one: don't run it from this environment where an untrusted network can reach it. If you separately run a ChromaDB server reachable from an untrusted network, treat it as vulnerable regardless of this integration. crewai also installs uv 0.11 (through crewai-cli, which pins uv~=0.11.6): every uv before 0.13.4 trusts a root CA whose intermediate keys are compromised (GHSA-hq85-5cpj-mr62), and crewai's own commands (crewai install, crewai run) use it to download packages. Nothing in this integration runs uv; the fix waits on crewai allowing uv 0.13.4.

CrewAI (v1.15.3+) exposes a global before_tool_call hook registry. install() registers a hook built on Gate.guard():

from intutic_clawde.gate import Gate, GateConfig, install as install_gate
from intutic_clawde.gate.adapters.crewai import install as install_crewai_gate

install_gate(Gate(GateConfig()))
install_crewai_gate()  # call once, at process start — before running any Crew

CrewAI's own documented veto contract: a before_tool_call hook returns False to block a call, True/None to allow it. install()'s hook returns False whenever Gate.guard() raises IntuticGateRefusal — and, deliberately, on any other exception too. CrewAI's dispatcher swallows any hook exception that is not its own internal abort signal and treats the call as allowed; this adapter cannot rely on CrewAI to fail closed on its behalf, so an unexpected error (a misconfigured gate, a bug) also blocks rather than silently passing through ungoverned.

4. Trace attribution

from intutic_clawde.gate import intutic_headers

llm = ChatOpenAI(
    base_url="http://localhost:4000/v1",
    default_headers=intutic_headers(session_id=run_id, harness="crewai"),
)

What gets written

Same shape as LangGraph's .env.intutic — proxy URLs plus a pointer at intutic_clawde.gate.adapters.crewai.install.

To undo what intutic gates install writes here, run intutic disconnect --harness crewai: each file goes back to what it held before Intutic first wrote it, or is deleted if Intutic created it, and edits you made since are kept. .env.intutic stays while another harness that writes it is still connected. See intutic disconnect.

What the adapter does NOT do

Same structural gaps as every SDK-gated framework — see LangGraph's "What the adapter does NOT do". In short: there is no sync-daemon hook file, argument-level gating requires calling install() in your own agent code, and x-intutic-harness attribution is client-supplied, not authorization.

Config details

Property	Value
Harness type	crewai
Config file	.env.intutic
Detection	crewai in pyproject.toml, requirements.txt, or uv.lock
Format	Shell environment variables
Write strategy	Atomic (write to .intutic-tmp, then rename)
Tool gate	SDK-side (intutic_clawde.gate.adapters.crewai.install, a before_tool_call hook) — no sync-daemon hook file