network-ai 4.0.6 → 4.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/INTEGRATION_GUIDE.md +470 -0
- package/README.md +2 -1
- package/bin/mcp-server.ts +3 -3
- package/dist/bin/mcp-server.d.ts +1 -1
- package/dist/bin/mcp-server.js +3 -3
- package/package.json +2 -1
|
@@ -0,0 +1,470 @@
|
|
|
1
|
+
# Network-AI Integration Guide
|
|
2
|
+
|
|
3
|
+
**For technical leads, solutions architects, and engineering teams evaluating or deploying Network-AI in a production environment.**
|
|
4
|
+
|
|
5
|
+
This guide walks from "we want this" to "it's running in production" — covering discovery, framework mapping, phased rollout, enterprise concerns, and validation.
|
|
6
|
+
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
## Table of Contents
|
|
10
|
+
|
|
11
|
+
1. [Before You Start — Discovery](#1-before-you-start--discovery)
|
|
12
|
+
2. [Framework Mapping](#2-framework-mapping)
|
|
13
|
+
3. [Primitive Mapping — What Solves What](#3-primitive-mapping--what-solves-what)
|
|
14
|
+
4. [Phased Rollout](#4-phased-rollout)
|
|
15
|
+
5. [Enterprise Concerns](#5-enterprise-concerns)
|
|
16
|
+
6. [Architecture Patterns](#6-architecture-patterns)
|
|
17
|
+
7. [Validation Checklist](#7-validation-checklist)
|
|
18
|
+
8. [Common Integration Mistakes](#8-common-integration-mistakes)
|
|
19
|
+
|
|
20
|
+
---
|
|
21
|
+
|
|
22
|
+
## 1. Before You Start — Discovery
|
|
23
|
+
|
|
24
|
+
Before touching any code, answer these questions. They determine which adapters you need and which governance primitives are non-negotiable.
|
|
25
|
+
|
|
26
|
+
### 1.1 Agent Inventory
|
|
27
|
+
|
|
28
|
+
Document every AI agent or automated process your team currently runs:
|
|
29
|
+
|
|
30
|
+
| Agent / Process | Language | Framework | Shares State With | Writes To |
|
|
31
|
+
|----------------|----------|-----------|-------------------|-----------|
|
|
32
|
+
| e.g. "invoice classifier" | Python | LangChain | "approvals bot" | Postgres |
|
|
33
|
+
| e.g. "customer triage" | Node | AutoGen | "CRM writer" | Salesforce API |
|
|
34
|
+
|
|
35
|
+
> **Why this matters:** Each row maps to one or more Network-AI adapters. Agents that share state with others are your highest-risk race condition points.
|
|
36
|
+
|
|
37
|
+
### 1.2 Race Condition Audit
|
|
38
|
+
|
|
39
|
+
For each pair of agents that write to the same resource, ask:
|
|
40
|
+
|
|
41
|
+
- Can both agents run at the same time?
|
|
42
|
+
- What happens if Agent A's write is overwritten by Agent B before Agent A reads it back?
|
|
43
|
+
- Is there any locking or retry logic today?
|
|
44
|
+
|
|
45
|
+
If the answer to the first question is "yes" and the second is "data loss / wrong decision / double spend" — that's a `LockedBlackboard` candidate.
|
|
46
|
+
|
|
47
|
+
### 1.3 Budget and Cost Exposure
|
|
48
|
+
|
|
49
|
+
- Do you have per-agent token limits today?
|
|
50
|
+
- Can a single runaway agent exhaust your OpenAI / Anthropic budget?
|
|
51
|
+
- Do you have hard cut-offs or just alerts?
|
|
52
|
+
|
|
53
|
+
Network-AI's `FederatedBudget` enforces hard ceilings. If you have no ceiling today, this is your first priority.
|
|
54
|
+
|
|
55
|
+
### 1.4 Compliance and Audit Requirements
|
|
56
|
+
|
|
57
|
+
- Does your industry require audit trails for automated decisions (GDPR, SOC 2, HIPAA, PCI-DSS)?
|
|
58
|
+
- Do you need to prove *which agent* made *which decision* and *when*?
|
|
59
|
+
- Are there regulatory rules about which systems an AI agent may access?
|
|
60
|
+
|
|
61
|
+
Answers drive `AuthGuardian` configuration and audit log retention policy.
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
## 2. Framework Mapping
|
|
66
|
+
|
|
67
|
+
Network-AI ships 12 adapters. Map your existing agents to the right one:
|
|
68
|
+
|
|
69
|
+
| Your Stack | Network-AI Adapter | Notes |
|
|
70
|
+
|-----------|-------------------|-------|
|
|
71
|
+
| LangChain (JS/TS) | `LangChainAdapter` | Supports Runnables, chains, agents |
|
|
72
|
+
| AutoGen / AG2 | `AutoGenAdapter` | Supports `.run()` and `.generateReply()` |
|
|
73
|
+
| CrewAI | `CrewAIAdapter` | Individual agents and full crew objects |
|
|
74
|
+
| OpenAI Assistants | `OpenAIAssistantsAdapter` | Thread management included |
|
|
75
|
+
| LlamaIndex | `LlamaIndexAdapter` | Query engines, chat engines, agent runners |
|
|
76
|
+
| Semantic Kernel | `SemanticKernelAdapter` | Microsoft SK kernels, functions, planners |
|
|
77
|
+
| Haystack | `HaystackAdapter` | Pipelines, agents, components |
|
|
78
|
+
| DSPy | `DSPyAdapter` | Modules, programs, predictors |
|
|
79
|
+
| Agno (ex-Phidata) | `AgnoAdapter` | Agents, teams, functions |
|
|
80
|
+
| MCP tools | `McpAdapter` | Tool serving and discovery |
|
|
81
|
+
| OpenClaw / Clawdbot / Moltbot | `OpenClawAdapter` | Native skill execution via `callSkill` |
|
|
82
|
+
| **Anything else** | `CustomAdapter` | Wrap any async function or HTTP endpoint |
|
|
83
|
+
|
|
84
|
+
### No matching framework?
|
|
85
|
+
|
|
86
|
+
Use `CustomAdapter`. Any async function becomes a governed agent in three lines:
|
|
87
|
+
|
|
88
|
+
```typescript
|
|
89
|
+
import { CustomAdapter } from 'network-ai';
|
|
90
|
+
|
|
91
|
+
const adapter = new CustomAdapter();
|
|
92
|
+
adapter.registerHandler('my-agent', async (payload) => {
|
|
93
|
+
// your existing logic here — unchanged
|
|
94
|
+
return { result: '...' };
|
|
95
|
+
});
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
This is the recommended entry point for **legacy systems**, **internal microservices**, and **REST APIs** — you do not need to rewrite anything.
|
|
99
|
+
|
|
100
|
+
---
|
|
101
|
+
|
|
102
|
+
## 3. Primitive Mapping — What Solves What
|
|
103
|
+
|
|
104
|
+
Match your problem to the Network-AI primitive:
|
|
105
|
+
|
|
106
|
+
| Problem | Primitive | How |
|
|
107
|
+
|---------|-----------|-----|
|
|
108
|
+
| Two agents overwriting each other's data | `LockedBlackboard` | Atomic `propose → validate → commit` with file-system mutex |
|
|
109
|
+
| Agent overspending token budget | `FederatedBudget` | Per-agent ceiling; hard cut-off on overspend |
|
|
110
|
+
| Agent accessing a resource it shouldn't | `AuthGuardian` + `SecureTokenManager` | HMAC-signed scoped tokens required at every sensitive operation |
|
|
111
|
+
| No audit trail for automated decisions | Audit log (`data/audit_log.jsonl`) | Cryptographic HMAC-signed chain, every write recorded |
|
|
112
|
+
| Agent running out of turn / taking too many actions | `ComplianceMonitor` | TOOL_ABUSE, TURN_TAKING, RESPONSE_TIMEOUT, JOURNEY_TIMEOUT detected in real time |
|
|
113
|
+
| Workflow needs defined states (e.g. INTAKE → REVIEW → APPROVE) | `JourneyFSM` | State machine gates which agents may act in which states |
|
|
114
|
+
| Content safety / hallucination in agent outputs | `QualityGateAgent` + `BlackboardValidator` | Two-layer validation before output enters the blackboard |
|
|
115
|
+
| Race conditions in parallel agent writes | `LockedBlackboard` with `priority-wins` | Higher-priority agents preempt lower-priority writes on conflict |
|
|
116
|
+
| Need to expose all tools to an AI via MCP | `McpSseServer` + `network-ai-server` | HTTP/SSE server at `GET /sse`, `POST /mcp`, `GET /tools` |
|
|
117
|
+
| Runtime AI control of the orchestrator | `ControlMcpTools` | AI can read/set config, spawn/stop agents, drive FSM transitions |
|
|
118
|
+
|
|
119
|
+
---
|
|
120
|
+
|
|
121
|
+
## 4. Phased Rollout
|
|
122
|
+
|
|
123
|
+
Do not try to enable everything at once. This is the recommended sequence for a zero-disruption integration:
|
|
124
|
+
|
|
125
|
+
### Phase 1 — Wrap (Day 1–3)
|
|
126
|
+
|
|
127
|
+
**Goal:** Get your existing agents running inside Network-AI without changing their behaviour.
|
|
128
|
+
|
|
129
|
+
1. `npm install network-ai`
|
|
130
|
+
2. Wrap each agent in the matching adapter (see §2)
|
|
131
|
+
3. Register all adapters with `AdapterRegistry`
|
|
132
|
+
4. Replace direct agent calls with `registry.executeAgent(...)` or `orchestrator.execute(...)`
|
|
133
|
+
5. Run `npm run demo -- --08` to verify the framework itself is healthy in your environment
|
|
134
|
+
|
|
135
|
+
**Nothing changes behaviourally yet.** This phase is purely structural.
|
|
136
|
+
|
|
137
|
+
```typescript
|
|
138
|
+
import { createSwarmOrchestrator, CustomAdapter } from 'network-ai';
|
|
139
|
+
|
|
140
|
+
const orchestrator = createSwarmOrchestrator({ swarmName: 'acme-swarm' });
|
|
141
|
+
const adapter = new CustomAdapter();
|
|
142
|
+
|
|
143
|
+
// Wrap your existing function — unchanged
|
|
144
|
+
adapter.registerHandler('invoice-classifier', async (payload) => {
|
|
145
|
+
return await yourExistingClassifier(payload.params);
|
|
146
|
+
});
|
|
147
|
+
|
|
148
|
+
await orchestrator.addAdapter(adapter);
|
|
149
|
+
```
|
|
150
|
+
|
|
151
|
+
---
|
|
152
|
+
|
|
153
|
+
### Phase 2 — Shared State (Day 3–7)
|
|
154
|
+
|
|
155
|
+
**Goal:** Replace ad-hoc shared resources (databases, files, in-memory objects) with the blackboard.
|
|
156
|
+
|
|
157
|
+
1. Identify all keys agents share (from your §1.1 audit)
|
|
158
|
+
2. Introduce `SharedBlackboard` for low-contention data
|
|
159
|
+
3. Introduce `LockedBlackboard` for any key that two or more agents write to concurrently
|
|
160
|
+
|
|
161
|
+
```typescript
|
|
162
|
+
import { LockedBlackboard } from 'network-ai';
|
|
163
|
+
|
|
164
|
+
const board = new LockedBlackboard('.', { conflictResolution: 'priority-wins' });
|
|
165
|
+
|
|
166
|
+
// Atomic write — no other agent can interfere during this operation
|
|
167
|
+
const changeId = board.proposeChange('account:balance', newBalance, 'payment-agent');
|
|
168
|
+
board.validateChange(changeId);
|
|
169
|
+
board.commitChange(changeId);
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
> **Migration tip:** Start by shadowing — write to both your existing DB and the blackboard simultaneously. Once you're confident they match, remove the DB writes.
|
|
173
|
+
|
|
174
|
+
---
|
|
175
|
+
|
|
176
|
+
### Phase 3 — Budget Enforcement (Day 7–10)
|
|
177
|
+
|
|
178
|
+
**Goal:** Add hard token ceilings so no single agent can exhaust your LLM budget.
|
|
179
|
+
|
|
180
|
+
```typescript
|
|
181
|
+
import { FederatedBudget } from 'network-ai/lib/federated-budget';
|
|
182
|
+
|
|
183
|
+
const budget = new FederatedBudget({
|
|
184
|
+
pools: {
|
|
185
|
+
'classifier': { ceiling: 50_000 }, // tokens per run
|
|
186
|
+
'summarizer': { ceiling: 100_000 },
|
|
187
|
+
'orchestrator': { ceiling: 200_000 },
|
|
188
|
+
}
|
|
189
|
+
});
|
|
190
|
+
|
|
191
|
+
// Check before each LLM call
|
|
192
|
+
const check = budget.canSpend('classifier', estimatedTokens);
|
|
193
|
+
if (!check.allowed) throw new Error(`Budget ceiling reached: ${check.reason}`);
|
|
194
|
+
|
|
195
|
+
// Record actual spend after
|
|
196
|
+
budget.recordSpend('classifier', actualTokens);
|
|
197
|
+
```
|
|
198
|
+
|
|
199
|
+
Map your cost centers to pool names. Budget state persists across agent runs.
|
|
200
|
+
|
|
201
|
+
---
|
|
202
|
+
|
|
203
|
+
### Phase 4 — Access Control (Day 10–14)
|
|
204
|
+
|
|
205
|
+
**Goal:** Gate access to sensitive APIs and resources behind cryptographically signed tokens.
|
|
206
|
+
|
|
207
|
+
1. Define your resources and risk levels (see `references/auth-guardian.md`)
|
|
208
|
+
2. Map your agents to trust levels (see `references/trust-levels.md`)
|
|
209
|
+
3. Replace direct API calls with `AuthGuardian`-gated calls
|
|
210
|
+
|
|
211
|
+
```typescript
|
|
212
|
+
import { AuthGuardian, SecureTokenManager } from 'network-ai';
|
|
213
|
+
|
|
214
|
+
const guardian = new AuthGuardian();
|
|
215
|
+
const tokenManager = new SecureTokenManager(process.env.HMAC_SECRET!);
|
|
216
|
+
|
|
217
|
+
// Agent requests access with a justification
|
|
218
|
+
const request = await guardian.requestPermission({
|
|
219
|
+
agentId: 'payment-agent',
|
|
220
|
+
resource: 'PAYMENTS',
|
|
221
|
+
action: 'write',
|
|
222
|
+
justification: 'Processing approved invoice #INV-2847 per workflow step 3',
|
|
223
|
+
trustLevel: 0.8,
|
|
224
|
+
});
|
|
225
|
+
|
|
226
|
+
if (request.approved) {
|
|
227
|
+
const token = tokenManager.createToken('payment-agent', ['PAYMENTS:write'], 300);
|
|
228
|
+
// pass token to downstream call
|
|
229
|
+
}
|
|
230
|
+
```
|
|
231
|
+
|
|
232
|
+
**IAM integration:** The token payload (agentId, permissions, expiry) can be forwarded as a JWT claim to your existing IAM layer. Network-AI does not replace your IAM — it sits in front of it as a pre-authorization layer.
|
|
233
|
+
|
|
234
|
+
---
|
|
235
|
+
|
|
236
|
+
### Phase 5 — Governance and FSM (Day 14–21)
|
|
237
|
+
|
|
238
|
+
**Goal:** Define explicit workflow states so agents can only act when the system is in the right state.
|
|
239
|
+
|
|
240
|
+
```typescript
|
|
241
|
+
import { JourneyFSM, WORKFLOW_STATES } from 'network-ai';
|
|
242
|
+
|
|
243
|
+
const fsm = new JourneyFSM({
|
|
244
|
+
agentId: 'workflow',
|
|
245
|
+
journeyId: 'invoice-processing',
|
|
246
|
+
transitions: [
|
|
247
|
+
{ from: 'INTAKE', to: 'ANALYZE', allowedAgents: ['intake-agent'] },
|
|
248
|
+
{ from: 'ANALYZE', to: 'APPROVE', allowedAgents: ['analyst-agent'] },
|
|
249
|
+
{ from: 'APPROVE', to: 'EXECUTE', allowedAgents: ['approver-agent'] },
|
|
250
|
+
{ from: 'EXECUTE', to: 'DELIVER', allowedAgents: ['payment-agent'] },
|
|
251
|
+
]
|
|
252
|
+
});
|
|
253
|
+
|
|
254
|
+
// Before any agent acts, check the FSM
|
|
255
|
+
const canAct = fsm.canTransition(currentState, nextState, agentId);
|
|
256
|
+
```
|
|
257
|
+
|
|
258
|
+
Add `ComplianceMonitor` to detect violations in real time without blocking the main thread:
|
|
259
|
+
|
|
260
|
+
```typescript
|
|
261
|
+
import { ComplianceMonitor } from 'network-ai';
|
|
262
|
+
|
|
263
|
+
const monitor = new ComplianceMonitor(fsm, {
|
|
264
|
+
maxActionsPerTurn: 5,
|
|
265
|
+
responseTimeoutMs: 30_000,
|
|
266
|
+
journeyTimeoutMs: 300_000,
|
|
267
|
+
});
|
|
268
|
+
monitor.start(1_000); // poll every second
|
|
269
|
+
```
|
|
270
|
+
|
|
271
|
+
---
|
|
272
|
+
|
|
273
|
+
### Phase 6 — Observability and MCP (Day 21+)
|
|
274
|
+
|
|
275
|
+
**Goal:** Expose everything to your monitoring stack and optionally give your AI models control-plane access.
|
|
276
|
+
|
|
277
|
+
Start the MCP server (exposes 20+ tools via SSE/JSON-RPC):
|
|
278
|
+
|
|
279
|
+
```bash
|
|
280
|
+
npx network-ai-server --port 3001 --audit-log data/audit_log.jsonl --ceiling 500000
|
|
281
|
+
```
|
|
282
|
+
|
|
283
|
+
Connect your AI model to `http://localhost:3001/sse` — it can now:
|
|
284
|
+
- Read and write live config (`config_get`, `config_set`)
|
|
285
|
+
- Spawn and stop agents (`agent_spawn`, `agent_stop`)
|
|
286
|
+
- Drive FSM transitions (`fsm_transition`)
|
|
287
|
+
- Query the audit log (`audit_query`, `audit_tail`)
|
|
288
|
+
- Check and top up budgets (`budget_status`, `budget_spend`)
|
|
289
|
+
|
|
290
|
+
---
|
|
291
|
+
|
|
292
|
+
## 5. Enterprise Concerns
|
|
293
|
+
|
|
294
|
+
### Authentication & IAM
|
|
295
|
+
|
|
296
|
+
Network-AI does **not** require or replace an external IAM system. `AuthGuardian` operates as a **pre-authorization layer**:
|
|
297
|
+
|
|
298
|
+
```
|
|
299
|
+
AI Agent → AuthGuardian (justification scoring) → your IAM (final auth) → resource
|
|
300
|
+
```
|
|
301
|
+
|
|
302
|
+
The HMAC secret (`HMAC_SECRET` env var) should be rotated on the same schedule as your other API keys and stored in your secret manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault).
|
|
303
|
+
|
|
304
|
+
### Audit Log Retention
|
|
305
|
+
|
|
306
|
+
The audit log at `data/audit_log.jsonl` is a HMAC-signed append-only chain. Each entry contains: timestamp, agentId, eventType, resource, outcome, and a chain signature.
|
|
307
|
+
|
|
308
|
+
- **GDPR / right to erasure:** Entries are immutable by design. If data subject erasure applies, store identifying data outside the log and reference only pseudonymized agent IDs inside it.
|
|
309
|
+
- **Retention:** Rotate files using your standard log rotation tooling (logrotate, Fluentd, etc.). The chain continues across files — verification just needs the previous file's last hash.
|
|
310
|
+
- **SIEM integration:** Stream `audit_log.jsonl` to Splunk, Datadog, or Elastic via the `audit_tail` MCP tool or a simple `tail -F` feed.
|
|
311
|
+
|
|
312
|
+
### Air-Gapped / On-Prem Deployment
|
|
313
|
+
|
|
314
|
+
Network-AI has **zero required external network calls**. All operations (blackboard, FSM, compliance, budget, tokens, audit) run entirely on-premises:
|
|
315
|
+
|
|
316
|
+
- No telemetry, no call-home, no cloud dependency
|
|
317
|
+
- LLM calls only happen if *you* add an adapter that calls an LLM — e.g. `OpenAIAssistantsAdapter` will call `api.openai.com`, but this is your explicit choice
|
|
318
|
+
- The MCP server (`network-ai-server`) binds to localhost by default; deploy behind your internal API gateway to expose it to your agent fleet
|
|
319
|
+
|
|
320
|
+
### Multi-Tenant Deployments
|
|
321
|
+
|
|
322
|
+
Isolate tenants by:
|
|
323
|
+
1. **Separate blackboard roots** — each tenant gets their own directory path passed to `LockedBlackboard(tenantPath)`
|
|
324
|
+
2. **Separate budget pools** — prefix pool names with tenant ID: `tenant-abc:classifier`
|
|
325
|
+
3. **Separate HMAC secrets** — one `SecureTokenManager` instance per tenant
|
|
326
|
+
4. **Namespace scoping** — use consistent key prefixes in the blackboard (e.g. `tenant-abc:invoice:42`)
|
|
327
|
+
|
|
328
|
+
### Scaling
|
|
329
|
+
|
|
330
|
+
Network-AI is a **single-process orchestrator** by design — it does not require a broker, queue, or service mesh. For horizontal scaling:
|
|
331
|
+
|
|
332
|
+
- **Shared `LockedBlackboard`:** Point multiple instances at the same directory on a shared volume (NFS, EFS, Azure Files). File-system mutexes work across processes on the same mount.
|
|
333
|
+
- **Independent budget tracking:** Each instance tracks its own pool. Use a sidecar or the `audit_tail` MCP tool to aggregate spend across instances.
|
|
334
|
+
- **FSM per workflow:** One `JourneyFSM` per workflow instance, not per process. FSM state persists to the blackboard, so any process can resume an interrupted journey.
|
|
335
|
+
|
|
336
|
+
---
|
|
337
|
+
|
|
338
|
+
## 6. Architecture Patterns
|
|
339
|
+
|
|
340
|
+
### Pattern A — Sidecar (Minimal Disruption)
|
|
341
|
+
|
|
342
|
+
Keep your existing agent orchestration. Add Network-AI only for coordination, safety, and audit on the shared state layer.
|
|
343
|
+
|
|
344
|
+
```
|
|
345
|
+
[Existing LangChain agent] ──writes──▶ [LockedBlackboard] ◀──reads── [Existing AutoGen agent]
|
|
346
|
+
│
|
|
347
|
+
[Audit log]
|
|
348
|
+
[Budget tracking]
|
|
349
|
+
```
|
|
350
|
+
|
|
351
|
+
No changes to your agent code. Network-AI wraps the shared resource only.
|
|
352
|
+
|
|
353
|
+
---
|
|
354
|
+
|
|
355
|
+
### Pattern B — Full Orchestrator
|
|
356
|
+
|
|
357
|
+
Network-AI owns the entire agent lifecycle. All agents run through the adapter registry.
|
|
358
|
+
|
|
359
|
+
```
|
|
360
|
+
User request
|
|
361
|
+
│
|
|
362
|
+
▼
|
|
363
|
+
SwarmOrchestrator
|
|
364
|
+
│
|
|
365
|
+
├──▶ AuthGuardian (permission check)
|
|
366
|
+
├──▶ JourneyFSM (state gate)
|
|
367
|
+
├──▶ FederatedBudget (cost check)
|
|
368
|
+
│
|
|
369
|
+
├──▶ LangChainAdapter ──▶ your LangChain agent
|
|
370
|
+
├──▶ AutoGenAdapter ──▶ your AutoGen agent
|
|
371
|
+
└──▶ CustomAdapter ──▶ your existing functions
|
|
372
|
+
```
|
|
373
|
+
|
|
374
|
+
---
|
|
375
|
+
|
|
376
|
+
### Pattern C — MCP Control Plane
|
|
377
|
+
|
|
378
|
+
Your AI model connects to `network-ai-server` via SSE and drives the whole system through MCP tools — no hand-coded orchestration logic at all.
|
|
379
|
+
|
|
380
|
+
```
|
|
381
|
+
AI Model (Claude / GPT-4o)
|
|
382
|
+
│ SSE/JSON-RPC
|
|
383
|
+
▼
|
|
384
|
+
network-ai-server (port 3001)
|
|
385
|
+
│
|
|
386
|
+
├── ControlMcpTools (spawn agents, drive FSM, set config)
|
|
387
|
+
├── ExtendedMcpTools (budget, tokens, audit)
|
|
388
|
+
└── BlackboardMCPTools (read/write blackboard)
|
|
389
|
+
```
|
|
390
|
+
|
|
391
|
+
---
|
|
392
|
+
|
|
393
|
+
## 7. Validation Checklist
|
|
394
|
+
|
|
395
|
+
Run these before declaring the integration production-ready:
|
|
396
|
+
|
|
397
|
+
### Functional
|
|
398
|
+
|
|
399
|
+
- [ ] All agents execute via the adapter registry without errors
|
|
400
|
+
- [ ] `npx ts-node test-standalone.ts` — 79 core tests pass
|
|
401
|
+
- [ ] `npx ts-node test-security.ts` — 33 security tests pass
|
|
402
|
+
- [ ] `npx ts-node test-adapters.ts` — 139 adapter tests pass
|
|
403
|
+
- [ ] `npx ts-node test-phase4.ts` — 147 behavioral tests pass
|
|
404
|
+
- [ ] `npm run demo -- --08` runs to completion in < 10 seconds
|
|
405
|
+
|
|
406
|
+
### Race Condition Safety
|
|
407
|
+
|
|
408
|
+
- [ ] Two agents can write to the same blackboard key concurrently without data loss
|
|
409
|
+
- [ ] `LockedBlackboard.validateChange()` rejects a stale change after a conflict
|
|
410
|
+
- [ ] `priority-wins` correctly overwrites a lower-priority pending write
|
|
411
|
+
|
|
412
|
+
### Budget Enforcement
|
|
413
|
+
|
|
414
|
+
- [ ] Spending past the ceiling throws / returns `allowed: false`
|
|
415
|
+
- [ ] Budget state persists across process restart
|
|
416
|
+
- [ ] Per-agent pools are independent (overspending in pool A does not affect pool B)
|
|
417
|
+
|
|
418
|
+
### Access Control
|
|
419
|
+
|
|
420
|
+
- [ ] A token issued by `SecureTokenManager` validates correctly
|
|
421
|
+
- [ ] An expired token is rejected
|
|
422
|
+
- [ ] A token with insufficient scope is rejected at the `AuthGuardian` gate
|
|
423
|
+
- [ ] `--active-grants` shows the correct active token set
|
|
424
|
+
|
|
425
|
+
### Compliance
|
|
426
|
+
|
|
427
|
+
- [ ] `ComplianceMonitor` fires `TOOL_ABUSE` after the configured action threshold
|
|
428
|
+
- [ ] `RESPONSE_TIMEOUT` fires when an agent exceeds the timeout window
|
|
429
|
+
- [ ] `JOURNEY_TIMEOUT` fires when the overall journey exceeds its ceiling
|
|
430
|
+
- [ ] FSM blocks a transition attempted by an unauthorized agent
|
|
431
|
+
|
|
432
|
+
### Audit
|
|
433
|
+
|
|
434
|
+
- [ ] Every blackboard write produces a signed entry in `audit_log.jsonl`
|
|
435
|
+
- [ ] `audit_query` returns filtered results correctly
|
|
436
|
+
- [ ] The audit chain signature is intact after N entries (run the chain verifier)
|
|
437
|
+
|
|
438
|
+
---
|
|
439
|
+
|
|
440
|
+
## 8. Common Integration Mistakes
|
|
441
|
+
|
|
442
|
+
| Mistake | Consequence | Fix |
|
|
443
|
+
|---------|-------------|-----|
|
|
444
|
+
| Using `SharedBlackboard` for concurrent writes | Race conditions / data loss | Use `LockedBlackboard` for any key two agents write to |
|
|
445
|
+
| Not committing the lock file (`package-lock.json`) | CI `npm ci` fails on Node version mismatch | Always commit `package-lock.json` after version bumps |
|
|
446
|
+
| Not including `socket.json` in `package.json` `files` | Socket.dev ignores aren't shipped; supply chain score drops | Add `socket.json` to the `files` array |
|
|
447
|
+
| Hardcoded agent IDs in trust level config | Agent added later gets default 0.5 trust and is silently denied | Maintain a central trust registry; register new agents before deploying |
|
|
448
|
+
| One `FederatedBudget` pool shared by all agents | One runaway agent exhausts budget for everyone | One pool per agent or per role |
|
|
449
|
+
| FSM with no timeout | Stuck workflow holds locks indefinitely | Always set `timeoutMs` on states that involve external calls |
|
|
450
|
+
| Storing PII as blackboard keys | Audit log contains PII in plain text | Use pseudonymised keys; store PII in a separate encrypted store |
|
|
451
|
+
| Running `network-ai-server` on `0.0.0.0` in production | MCP control plane is publicly accessible | Bind to localhost and expose via authenticated internal API gateway only |
|
|
452
|
+
|
|
453
|
+
---
|
|
454
|
+
|
|
455
|
+
## Further Reading
|
|
456
|
+
|
|
457
|
+
| Document | What It Covers |
|
|
458
|
+
|----------|---------------|
|
|
459
|
+
| [QUICKSTART.md](QUICKSTART.md) | Get running in 5 minutes |
|
|
460
|
+
| [references/adapter-system.md](references/adapter-system.md) | All 12 adapters with code examples |
|
|
461
|
+
| [references/trust-levels.md](references/trust-levels.md) | Trust scoring formula and agent roles |
|
|
462
|
+
| [references/auth-guardian.md](references/auth-guardian.md) | Permission system, justification scoring, token lifecycle |
|
|
463
|
+
| [references/blackboard-schema.md](references/blackboard-schema.md) | Blackboard key conventions and namespacing |
|
|
464
|
+
| [references/mcp-roadmap.md](references/mcp-roadmap.md) | MCP server tools reference |
|
|
465
|
+
| [examples/README.md](examples/README.md) | All runnable demos |
|
|
466
|
+
| [CHANGELOG.md](CHANGELOG.md) | Full version history |
|
|
467
|
+
|
|
468
|
+
---
|
|
469
|
+
|
|
470
|
+
*Network-AI v4.0.6 · MIT License · https://github.com/jovanSAPFIONEER/Network-AI*
|
package/README.md
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
|
|
5
5
|
[](https://github.com/jovanSAPFIONEER/Network-AI/actions/workflows/ci.yml)
|
|
6
6
|
[](https://github.com/jovanSAPFIONEER/Network-AI/actions/workflows/codeql.yml)
|
|
7
|
-
[](https://github.com/jovanSAPFIONEER/Network-AI/releases)
|
|
8
8
|
[](https://www.npmjs.com/package/network-ai)
|
|
9
9
|
[](https://clawhub.ai/skills/network-ai)
|
|
10
10
|
[](https://nodejs.org)
|
|
@@ -16,6 +16,7 @@
|
|
|
16
16
|
[](#testing)
|
|
17
17
|
[](#adapter-system)
|
|
18
18
|
[](https://github.com/jovanSAPFIONEER/Network-AI/releases.atom)
|
|
19
|
+
[](INTEGRATION_GUIDE.md)
|
|
19
20
|
|
|
20
21
|
> **Legacy Users:** This skill works with **Clawdbot** and **Moltbot** (now OpenClaw). If you're searching for *Moltbot Security*, *Clawdbot Swarm*, or *Moltbot multi-agent* -- you're in the right place!
|
|
21
22
|
|
package/bin/mcp-server.ts
CHANGED
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
* http://localhost:3001/tools (list all tools)
|
|
30
30
|
*
|
|
31
31
|
* @module bin/mcp-server
|
|
32
|
-
* @version 4.0.
|
|
32
|
+
* @version 4.0.7
|
|
33
33
|
*/
|
|
34
34
|
|
|
35
35
|
import {
|
|
@@ -103,7 +103,7 @@ function parseArgs(argv: string[]): ServerArgs {
|
|
|
103
103
|
|
|
104
104
|
function printHelp(): void {
|
|
105
105
|
console.log(`
|
|
106
|
-
network-ai-server — Network-AI MCP Server v4.0.
|
|
106
|
+
network-ai-server — Network-AI MCP Server v4.0.7
|
|
107
107
|
|
|
108
108
|
Usage: npx ts-node bin/mcp-server.ts [options]
|
|
109
109
|
|
|
@@ -140,7 +140,7 @@ async function main(): Promise<void> {
|
|
|
140
140
|
process.exit(0);
|
|
141
141
|
}
|
|
142
142
|
|
|
143
|
-
console.log(`\n[network-ai-server] Starting MCP Server v4.0.
|
|
143
|
+
console.log(`\n[network-ai-server] Starting MCP Server v4.0.7`);
|
|
144
144
|
console.log(`[network-ai-server] Board: ${args.board} | Port: ${args.port}`);
|
|
145
145
|
|
|
146
146
|
// --------------------------------------------------------------------------
|
package/dist/bin/mcp-server.d.ts
CHANGED
package/dist/bin/mcp-server.js
CHANGED
|
@@ -30,7 +30,7 @@
|
|
|
30
30
|
* http://localhost:3001/tools (list all tools)
|
|
31
31
|
*
|
|
32
32
|
* @module bin/mcp-server
|
|
33
|
-
* @version 4.0.
|
|
33
|
+
* @version 4.0.7
|
|
34
34
|
*/
|
|
35
35
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
36
36
|
const index_1 = require("../index");
|
|
@@ -102,7 +102,7 @@ function parseArgs(argv) {
|
|
|
102
102
|
}
|
|
103
103
|
function printHelp() {
|
|
104
104
|
console.log(`
|
|
105
|
-
network-ai-server — Network-AI MCP Server v4.0.
|
|
105
|
+
network-ai-server — Network-AI MCP Server v4.0.7
|
|
106
106
|
|
|
107
107
|
Usage: npx ts-node bin/mcp-server.ts [options]
|
|
108
108
|
|
|
@@ -135,7 +135,7 @@ async function main() {
|
|
|
135
135
|
printHelp();
|
|
136
136
|
process.exit(0);
|
|
137
137
|
}
|
|
138
|
-
console.log(`\n[network-ai-server] Starting MCP Server v4.0.
|
|
138
|
+
console.log(`\n[network-ai-server] Starting MCP Server v4.0.7`);
|
|
139
139
|
console.log(`[network-ai-server] Board: ${args.board} | Port: ${args.port}`);
|
|
140
140
|
// --------------------------------------------------------------------------
|
|
141
141
|
// 1. Create orchestrator + blackboard
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "network-ai",
|
|
3
|
-
"version": "4.0.
|
|
3
|
+
"version": "4.0.7",
|
|
4
4
|
"description": "AI agent orchestration framework for TypeScript/Node.js - plug-and-play multi-agent coordination with 12 frameworks (LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw). Built-in security, swarm intelligence, and agentic workflow patterns.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -95,6 +95,7 @@
|
|
|
95
95
|
"scripts/",
|
|
96
96
|
"README.md",
|
|
97
97
|
"QUICKSTART.md",
|
|
98
|
+
"INTEGRATION_GUIDE.md",
|
|
98
99
|
"SKILL.md",
|
|
99
100
|
"LICENSE",
|
|
100
101
|
"socket.json"
|