faramesh init

faramesh init is the first command you run in any new agent project. It inspects your repository, picks a framework profile, finds every tool registration in source, and writes a starter governance.fms you can edit and ship.

This page is the full reference. For the five-minute walkthrough see Quickstart; for a fully worked agent see Govern your first LangGraph agent.

Usage

faramesh init [flags]

Framework detection

Faramesh inspects your manifests in this order and picks the first match:

If more than one matches, Faramesh prompts you to choose. With --non-interactive, multiple matches resolve to an unknown framework and you select manually in governance.fms.

Tool discovery

For Python and TypeScript projects, Faramesh scans for tool registrations and adds them to the rules block at defer:

Every discovered tool is added as a comment plus a defer rule. Defer is the safe default: nothing runs until you explicitly review and promote each rule to permit.

Output

A typical first run:

$ faramesh init
✓ Framework detected: langgraph
✓ Tools discovered: 3 (search_docs, send_email, charge_card)
✓ governance.fms written

Next steps:
  Run your agent with governance:
    faramesh dev
  Review what your agent is doing:
    faramesh approvals list
  When ready for full enforcement:
    faramesh apply

The generated file is intentionally minimal. The intent is: commit it, edit rules to fit your security posture, run faramesh check, then faramesh dev or faramesh apply.

Generated file

A typical Python LangGraph project produces something like:

import "github.com/faramesh/faramesh-registry/frameworks/langgraph@1.0.0"

runtime {
  mode    = "enforce"
  wal_dir = "./faramesh-wal"
  backend = "sqlite"
}

agent "myproject-agent" {
  default deny

  rules {
    defer search_docs
    defer send_email
    defer charge_card
  }

  budget daily {
    max       $10
    on_exceed deny
  }

  egress { }
}

Three things to know about this file:

1. default deny is the only safe default. Every permit must be explicit.
2. Every discovered tool is defer. When the agent first runs, you'll see each tool show up in the approvals queue. That's the signal to either promote it to permit or leave it on a human-in-the-loop ladder.
3. The import line is pinned. The registry resolves at faramesh check time; pinned imports give you reproducible builds. @latest is rejected.

What's next

• Tune the policy: validate your edits.
• Run locally: start the daemon with in-process stubs.
• FPL reference: every block you can add.
• Stack reference: block-by-block semantics.
• Providers: declare Vault, AWS, GCP, Azure, SPIFFE.
• Quickstart: the five-step end-to-end walkthrough.