What 10xGraph does not protect

10xGraph enforces a lot at the server, and the readiness table says which. This page lists what it does not do, so you can plan for it. Each item says what to do.

Prompt injection is bounded, not removed

A model reads untrusted text: user messages, web pages, documents, tool output. Any of it can contain instructions. 10xGraph cannot make a model ignore them.

What it gives you is a smaller blast radius:

• Validators check input and output around the model.
• Approval through interrupt() pauses a run before a risky tool, so a person decides.
• Tool allow-lists limit which tools a node can call at all.
• Server-side rules mean a caller cannot set identity, the file tool root or the tool limits from the request.

What to do: give each agent only the tools it needs, put an approval step in front of tools that spend money, send messages or change data, and treat tool output as untrusted. See Protect against prompt injection, Security and validators and Add human approval.

Your tools’ business logic and authorization

The server decides whether a caller may start a run on a thread. It does not know what your refund_order or get_customer tool should allow. If a tool takes an id from the model, nothing stops the model from passing someone else’s id unless the tool checks.

What to do: inside each tool, check that the authenticated user may touch the object. The user id comes from the verified config, never from state or model output. See Dependency injection and Authorization scopes.

auth: null starts an open server

If auth is null, the server serves every route to anyone who can reach it. With MODE=production it still starts. Nothing refuses it. Ownership checks need an identity, so with no auth there is nobody to own a thread.

What to do: set "auth": "jwt" with a strong JWT_SECRET_KEY, or a custom BaseAuth class, before the server is reachable. The 10xgraph init production template does this for you. See Auth and the production checklist.

Secrets management

10xGraph reads secrets from the environment and redacts known secret formats in its logs. It does not store, rotate or encrypt them. Provider keys, JWT_SECRET_KEY and database URLs are yours to manage.

What to do: use your platform’s secret store, keep .env out of the image and the repository, and rotate keys on a schedule. See Production checklist.

TLS and network edge

The container serves plain HTTP. The server sets security headers and can emit HSTS, but it does not terminate TLS, filter by network, or protect against volumetric attacks.

What to do: terminate TLS at your load balancer or ingress, set ALLOWED_HOST and ORIGINS, and if you use client IP rate limiting behind a proxy, set rate_limit.trusted_proxies. See CORS and security headers and Kubernetes.

The default cache store is per process

Without a cache_store of type redis or custom, the API keeps its run locks, caps, idempotency state, rate-limit counters and token revocations in the memory of one process (InMemoryCacheStore). With more than one worker or replica those do not add up: a revocation reaches only one process, and caps multiply by the worker count. The store also caps its memory, so under heavy churn it evicts the least recently used rate-limit and cache entries (never run leases or revocations).

What to do: set cache_store.type to redis (or custom for your own store) for any multi-worker deployment, and run Redis with maxmemory-policy set to noeviction or a volatile-* policy. See Bring your own backend.

Data retention and backups

Threads, messages and uploaded files stay until something deletes them. Deleting a thread or message also releases the files it referenced, but 10xGraph sets no retention period and does not back up your database.

What to do: back up PostgreSQL, decide a retention policy, and delete threads when users ask. See Backup and restore.

Tools run at least once

Replay-safe tools record each finished call in the checkpointer and skip it on resume. The check runs on both the invoke and the streaming path. A crash before a tool returns, or in the short gap before its record is written, can repeat the tool. A tool that was running when a run was cancelled or crashed gets an error result on the next turn, and the model may call it again.

What to do: send an idempotency key derived from stable inputs (an order id, not a random value) to payment, email and ticket providers. See Replay-safe tools.

Versioning

10xGraph 1.0 is a release candidate until the final ships. From 1.0 the public API is stable under a deprecation policy: breaking changes only in a major release, after at least one minor of deprecation. The deprecated agentflow aliases stay until 2.0. The community is smaller than the older frameworks’.

What to do: pin exact versions, read the changelog before each upgrade, and run your tests and evals in CI first. See Test before production and the upgrade guides.

Python 3.12 or newer

The core and the API server require Python 3.12 or newer. Other runtimes can call a served agent through the REST API or the TypeScript client, but the graph itself is Python.

What to do: run the image from 10xgraph build, which defaults to Python 3.13. See Installation.