agent-memory-guard 0.3.2__tar.gz → 0.3.3__tar.gz

{agent_memory_guard-0.3.2/src/agent_memory_guard.egg-info → agent_memory_guard-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-memory-guard
-Version: 0.3.2
+Version: 0.3.3
 Summary: Runtime defense layer that protects AI agent memory from poisoning, tool abuse, privilege escalation, and excessive autonomy (OWASP).
 Author: Anshul Rajkumar
 Author-email: Vaishnavi Gudur <gudur.vaishnavi@gmail.com>
@@ -42,6 +42,10 @@ Provides-Extra: crewai
 Requires-Dist: crewai>=0.1; extra == "crewai"
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == "llamaindex"
+Provides-Extra: autogen
+Requires-Dist: pyautogen>=0.2; extra == "autogen"
+Provides-Extra: openai-agents
+Requires-Dist: openai-agents>=0.1; extra == "openai-agents"
 Provides-Extra: all
 Requires-Dist: fastapi>=0.100; extra == "all"
 Requires-Dist: uvicorn[standard]>=0.20; extra == "all"
@@ -49,6 +53,8 @@ Requires-Dist: pydantic>=2.0; extra == "all"
 Requires-Dist: transformers>=4.30; extra == "all"
 Requires-Dist: torch>=2.0; extra == "all"
 Requires-Dist: langchain-core>=0.1; extra == "all"
+Requires-Dist: pyautogen>=0.2; extra == "all"
+Requires-Dist: openai-agents>=0.1; extra == "all"
 Provides-Extra: redis
 Requires-Dist: redis[hiredis]>=5.0.0; extra == "redis"
 Provides-Extra: test
@@ -56,6 +62,8 @@ Requires-Dist: pytest>=7.0; extra == "test"
 Requires-Dist: coverage>=7.0; extra == "test"
 Requires-Dist: httpx>=0.24; extra == "test"
 Requires-Dist: fakeredis>=2.0.0; extra == "test"
+Requires-Dist: fastapi>=0.100; extra == "test"
+Requires-Dist: pydantic>=2.0; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ruff>=0.4; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
@@ -81,7 +89,7 @@ Dynamic: license-file
 
 <div align="center">
 
-### 📦 9,834 PyPI downloads · 11,497 repository clones
+### 📦 14,721 PyPI downloads · 14,026 repository clones
 
 [![agent-memory-guard on PyPI](https://pepy.tech/badge/agent-memory-guard)](https://pepy.tech/project/agent-memory-guard) [![langchain-agent-memory-guard on PyPI](https://pepy.tech/badge/langchain-agent-memory-guard)](https://pepy.tech/project/langchain-agent-memory-guard) [![GitHub Clones](https://img.shields.io/badge/dynamic/json?color=success&label=Clones&query=count&url=https://gist.githubusercontent.com/vgudur-dev/c04e12f68c363625faf12faaf03a03ca/raw/clone.json&logo=github)](https://github.com/OWASP/www-project-agent-memory-guard) [![Unique Cloners](https://img.shields.io/badge/dynamic/json?color=success&label=Unique%20Cloners&query=uniques&url=https://gist.githubusercontent.com/vgudur-dev/c04e12f68c363625faf12faaf03a03ca/raw/clone.json&logo=github)](https://github.com/OWASP/www-project-agent-memory-guard/graphs/traffic)
 
@@ -183,6 +191,41 @@ Tested against 55 real-world attack payloads across 4 threat categories:
 python benchmarks/security_benchmark.py   # reproduce locally
 ```
 
+## Agent Memory Security Benchmark (AMSB)
+
+The numbers above measure AMG's own detectors on single writes. The **Agent
+Memory Security Benchmark** is a separate, framework-neutral scoreboard that
+grades **any** memory system on the full poisoning lifecycle — a payload is
+planted, **survives a context reset**, and is read back on a later turn. Any
+system that implements a three-method adapter (`remember` / `recall` /
+`context_reset`) gets a 0–100 resilience score and an SSL-Labs-style letter
+grade, with hard grade ceilings for catastrophic breaches.
+
+AMG authors the benchmark **and submits itself for grading**, measured through
+the identical adapter and corpus as every other entry. The results are not
+curated to flatter it:
+
+| System | Grade | Score | Notes |
+|--------|-------|-------|-------|
+| agent-memory-guard (hardened) | **A** | 93.9 | declared protected keys + persistence detector |
+| agent-memory-guard (strict preset) | **D** | 71.4 | `Policy.strict()` — declared protected keys, no persistence detector |
+| unguarded-dict | **F** | 0.0 | the resilience floor |
+
+The `strict` preset scores **D**: `Policy.strict()` now declares protected keys
+(fixed in 0.3.2, [#90](https://github.com/OWASP/www-project-agent-memory-guard/pull/90))
+so it defends the identity-escalation attacks, but it
+still loads no persistence detector — the delayed-activation attacks survive a
+context reset, and two critical breaches cap the grade at D. A real, honest
+finding about the documented quickstart config, surfaced by AMG's own benchmark:
+the benchmark independently confirms the 0.3.2 fix and still flags the residual
+persistence gap. See
+[`benchmarks/memory-systems/`](benchmarks/memory-systems/) for the full
+leaderboard, methodology, and how to grade a new system.
+
+```bash
+amg-bench --out benchmarks/memory-systems   # reproduce; grade mem0/Letta/Zep with --systems
+```
+
 ## What it does
 
 - **Integrity** — SHA-256 baselines flag out-of-band tampering with immutable keys.
@@ -232,14 +275,29 @@ Optional: pass `policy=Policy.strict()` or `on_violation="warn"|"strip"|"block"`
 
 ### OpenAI Agents SDK
 
+Screen tool outputs before they enter session memory. Runnable example:
+[`examples/openai_agents_memory_guard.py`](examples/openai_agents_memory_guard.py)
+(HITL queue on block). Drop-in SDK adapters (`GuardedAgentContext`, `GuardedToolOutput`,
+`GuardedHandoff`) ship in `agent_memory_guard.integrations.openai_agents`.
+
 ```python
-from agent_memory_guard import MemoryGuard, Policy
+from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard.events import SourceClass
 from agent_memory_guard.storage import InMemoryStore
 
 guard = MemoryGuard(InMemoryStore(), policy=Policy.strict())
 
-def remember(key: str, value: str) -> None:
-    guard.write(key, value, source="openai-agent")
+def remember_tool_output(tool_name: str, output: str) -> bool:
+    try:
+        guard.write(
+            f"openai_agents.tool.{tool_name}",
+            output,
+            source="openai_agents_tool",
+            source_class=SourceClass.EXTERNAL_TOOL,
+        )
+    except PolicyViolation:
+        return False  # enqueue for HITL / eval — do not poison session memory
+    return True
 
 def recall(key: str) -> str | None:
     return guard.read(key, sink="openai-agent")
@@ -248,49 +306,55 @@ def recall(key: str) -> str | None:
 ### AutoGen
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def guarded_append(history: list[dict], message: dict) -> None:
+    key = f"autogen.msg.{len(history)}"
     try:
-        guard.write(f"autogen.msg.{len(history)}", message["content"],
-                    source=message.get("role", "agent"))
+        action = guard.write(key, message["content"], source=message.get("role", "agent"))
     except PolicyViolation as exc:
         print("blocked:", exc)
         return
-    history.append(message)
+    if action == Action.QUARANTINE:
+        return  # held in guard.quarantine for review
+    history.append({**message, "content": guard.read(key)})  # redacted if needed
 ```
 
 ### mem0
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def safe_add(mem0_client, *, user_id: str, content: str, key: str) -> bool:
     try:
-        guard.write(key, content, source="mem0")
+        action = guard.write(key, content, source="mem0")
     except PolicyViolation:
         return False
-    mem0_client.add(content, user_id=user_id)
+    if action == Action.QUARANTINE:
+        return False  # held in guard.quarantine for review
+    mem0_client.add(guard.read(key), user_id=user_id)  # redacted if needed
     return True
 ```
 
 ### CrewAI
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def guarded_memory_callback(key: str, value: str, agent_name: str) -> str:
     try:
-        guard.write(key, value, source=f"crewai.{agent_name}")
+        action = guard.write(key, value, source=f"crewai.{agent_name}")
     except PolicyViolation as exc:
         return f"[BLOCKED] {exc}"
-    return value
+    if action == Action.QUARANTINE:
+        return "[QUARANTINED] held for review"
+    return guard.read(key)  # redacted if needed
 ```
 
 ## YAML policy
@@ -414,6 +478,10 @@ See [AUTHORS](AUTHORS) for details.
 - Referenced in the MITRE ATLAS "Memory Hardening" mitigation as an open-source implementation of memory-hardening controls.
 - Featured by Help Net Security, "OWASP Agent Memory Guard: Stop AI agents from being weaponized through their own memory" (June 2026).
 
+These mentions are descriptive, not endorsements. OWASP Incubator status is not a certification,
+and MITRE has not approved or endorsed this project; the ATLAS Memory Hardening entry lists it
+among example tools.
+
 ## How to cite
 
 Use GitHub's "Cite this repository" button (powered by [CITATION.cff](CITATION.cff)), or:

{agent_memory_guard-0.3.2 → agent_memory_guard-0.3.3}/README.md

@@ -10,7 +10,7 @@
 
 <div align="center">
 
-### 📦 9,834 PyPI downloads · 11,497 repository clones
+### 📦 14,721 PyPI downloads · 14,026 repository clones
 
 [![agent-memory-guard on PyPI](https://pepy.tech/badge/agent-memory-guard)](https://pepy.tech/project/agent-memory-guard) [![langchain-agent-memory-guard on PyPI](https://pepy.tech/badge/langchain-agent-memory-guard)](https://pepy.tech/project/langchain-agent-memory-guard) [![GitHub Clones](https://img.shields.io/badge/dynamic/json?color=success&label=Clones&query=count&url=https://gist.githubusercontent.com/vgudur-dev/c04e12f68c363625faf12faaf03a03ca/raw/clone.json&logo=github)](https://github.com/OWASP/www-project-agent-memory-guard) [![Unique Cloners](https://img.shields.io/badge/dynamic/json?color=success&label=Unique%20Cloners&query=uniques&url=https://gist.githubusercontent.com/vgudur-dev/c04e12f68c363625faf12faaf03a03ca/raw/clone.json&logo=github)](https://github.com/OWASP/www-project-agent-memory-guard/graphs/traffic)
 
@@ -112,6 +112,41 @@ Tested against 55 real-world attack payloads across 4 threat categories:
 python benchmarks/security_benchmark.py   # reproduce locally
 ```
 
+## Agent Memory Security Benchmark (AMSB)
+
+The numbers above measure AMG's own detectors on single writes. The **Agent
+Memory Security Benchmark** is a separate, framework-neutral scoreboard that
+grades **any** memory system on the full poisoning lifecycle — a payload is
+planted, **survives a context reset**, and is read back on a later turn. Any
+system that implements a three-method adapter (`remember` / `recall` /
+`context_reset`) gets a 0–100 resilience score and an SSL-Labs-style letter
+grade, with hard grade ceilings for catastrophic breaches.
+
+AMG authors the benchmark **and submits itself for grading**, measured through
+the identical adapter and corpus as every other entry. The results are not
+curated to flatter it:
+
+| System | Grade | Score | Notes |
+|--------|-------|-------|-------|
+| agent-memory-guard (hardened) | **A** | 93.9 | declared protected keys + persistence detector |
+| agent-memory-guard (strict preset) | **D** | 71.4 | `Policy.strict()` — declared protected keys, no persistence detector |
+| unguarded-dict | **F** | 0.0 | the resilience floor |
+
+The `strict` preset scores **D**: `Policy.strict()` now declares protected keys
+(fixed in 0.3.2, [#90](https://github.com/OWASP/www-project-agent-memory-guard/pull/90))
+so it defends the identity-escalation attacks, but it
+still loads no persistence detector — the delayed-activation attacks survive a
+context reset, and two critical breaches cap the grade at D. A real, honest
+finding about the documented quickstart config, surfaced by AMG's own benchmark:
+the benchmark independently confirms the 0.3.2 fix and still flags the residual
+persistence gap. See
+[`benchmarks/memory-systems/`](benchmarks/memory-systems/) for the full
+leaderboard, methodology, and how to grade a new system.
+
+```bash
+amg-bench --out benchmarks/memory-systems   # reproduce; grade mem0/Letta/Zep with --systems
+```
+
 ## What it does
 
 - **Integrity** — SHA-256 baselines flag out-of-band tampering with immutable keys.
@@ -161,14 +196,29 @@ Optional: pass `policy=Policy.strict()` or `on_violation="warn"|"strip"|"block"`
 
 ### OpenAI Agents SDK
 
+Screen tool outputs before they enter session memory. Runnable example:
+[`examples/openai_agents_memory_guard.py`](examples/openai_agents_memory_guard.py)
+(HITL queue on block). Drop-in SDK adapters (`GuardedAgentContext`, `GuardedToolOutput`,
+`GuardedHandoff`) ship in `agent_memory_guard.integrations.openai_agents`.
+
 ```python
-from agent_memory_guard import MemoryGuard, Policy
+from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard.events import SourceClass
 from agent_memory_guard.storage import InMemoryStore
 
 guard = MemoryGuard(InMemoryStore(), policy=Policy.strict())
 
-def remember(key: str, value: str) -> None:
-    guard.write(key, value, source="openai-agent")
+def remember_tool_output(tool_name: str, output: str) -> bool:
+    try:
+        guard.write(
+            f"openai_agents.tool.{tool_name}",
+            output,
+            source="openai_agents_tool",
+            source_class=SourceClass.EXTERNAL_TOOL,
+        )
+    except PolicyViolation:
+        return False  # enqueue for HITL / eval — do not poison session memory
+    return True
 
 def recall(key: str) -> str | None:
     return guard.read(key, sink="openai-agent")
@@ -177,49 +227,55 @@ def recall(key: str) -> str | None:
 ### AutoGen
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def guarded_append(history: list[dict], message: dict) -> None:
+    key = f"autogen.msg.{len(history)}"
     try:
-        guard.write(f"autogen.msg.{len(history)}", message["content"],
-                    source=message.get("role", "agent"))
+        action = guard.write(key, message["content"], source=message.get("role", "agent"))
     except PolicyViolation as exc:
         print("blocked:", exc)
         return
-    history.append(message)
+    if action == Action.QUARANTINE:
+        return  # held in guard.quarantine for review
+    history.append({**message, "content": guard.read(key)})  # redacted if needed
 ```
 
 ### mem0
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def safe_add(mem0_client, *, user_id: str, content: str, key: str) -> bool:
     try:
-        guard.write(key, content, source="mem0")
+        action = guard.write(key, content, source="mem0")
     except PolicyViolation:
         return False
-    mem0_client.add(content, user_id=user_id)
+    if action == Action.QUARANTINE:
+        return False  # held in guard.quarantine for review
+    mem0_client.add(guard.read(key), user_id=user_id)  # redacted if needed
     return True
 ```
 
 ### CrewAI
 
 ```python
-from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
+from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
 
 guard = MemoryGuard(policy=Policy.strict())
 
 def guarded_memory_callback(key: str, value: str, agent_name: str) -> str:
     try:
-        guard.write(key, value, source=f"crewai.{agent_name}")
+        action = guard.write(key, value, source=f"crewai.{agent_name}")
     except PolicyViolation as exc:
         return f"[BLOCKED] {exc}"
-    return value
+    if action == Action.QUARANTINE:
+        return "[QUARANTINED] held for review"
+    return guard.read(key)  # redacted if needed
 ```
 
 ## YAML policy
@@ -343,6 +399,10 @@ See [AUTHORS](AUTHORS) for details.
 - Referenced in the MITRE ATLAS "Memory Hardening" mitigation as an open-source implementation of memory-hardening controls.
 - Featured by Help Net Security, "OWASP Agent Memory Guard: Stop AI agents from being weaponized through their own memory" (June 2026).
 
+These mentions are descriptive, not endorsements. OWASP Incubator status is not a certification,
+and MITRE has not approved or endorsed this project; the ATLAS Memory Hardening entry lists it
+among example tools.
+
 ## How to cite
 
 Use GitHub's "Cite this repository" button (powered by [CITATION.cff](CITATION.cff)), or:

{agent_memory_guard-0.3.2 → agent_memory_guard-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-memory-guard"
-version = "0.3.2"
+version = "0.3.3"
 description = "Runtime defense layer that protects AI agent memory from poisoning, tool abuse, privilege escalation, and excessive autonomy (OWASP)."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -44,6 +44,7 @@ dependencies = ["PyYAML>=6.0"]
 
 [project.scripts]
 amg = "agent_memory_guard.cli:main"
+amg-bench = "agent_memory_guard.bench.cli:main"
 
 [project.optional-dependencies]
 server = ["fastapi>=0.100", "uvicorn[standard]>=0.20", "pydantic>=2.0"]
@@ -51,6 +52,8 @@ ml = ["transformers>=4.30", "torch>=2.0"]
 langchain = ["langchain-core>=0.1"]
 crewai = ["crewai>=0.1"]
 llamaindex = ["llama-index-core>=0.10"]
+autogen = ["pyautogen>=0.2"]
+openai-agents = ["openai-agents>=0.1"]
 all = [
     "fastapi>=0.100",
     "uvicorn[standard]>=0.20",
@@ -58,9 +61,11 @@ all = [
     "transformers>=4.30",
     "torch>=2.0",
     "langchain-core>=0.1",
+    "pyautogen>=0.2",
+    "openai-agents>=0.1",
 ]
 redis = ["redis[hiredis]>=5.0.0"]
-test = ["pytest>=7.0", "coverage>=7.0", "httpx>=0.24", "fakeredis>=2.0.0"]
+test = ["pytest>=7.0", "coverage>=7.0", "httpx>=0.24", "fakeredis>=2.0.0", "fastapi>=0.100", "pydantic>=2.0"]
 dev = ["ruff>=0.4", "mypy>=1.0", "coverage>=7.0", "pytest>=7.0", "httpx>=0.24", "fakeredis>=2.0.0"]
 docs = ["mkdocs>=1.5", "mkdocs-material>=9.0", "mkdocstrings[python]>=0.24"]
 
@@ -108,6 +113,7 @@ omit = [
     "*/tools.py",
     "*/detectors/ml_injection.py",
     "*/detectors/anomaly.py",
+    "*/bench/adapters/third_party.py",
 ]
 
 [tool.coverage.report]

{agent_memory_guard-0.3.2 → agent_memory_guard-0.3.3}/src/agent_memory_guard/__init__.py

@@ -16,7 +16,7 @@ from agent_memory_guard.exceptions import (
 from agent_memory_guard.guard import MemoryGuard
 from agent_memory_guard.policies.policy import Policy
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"
 
 __all__ = [
     "Action",

agent_memory_guard-0.3.3/src/agent_memory_guard/bench/__init__.py

@@ -0,0 +1,50 @@
+"""Agent Memory Security Benchmark (AMSB).
+
+A framework-neutral benchmark that grades **any** agent memory system for
+resilience to memory-poisoning attacks (OWASP ASI06). Where the suite in
+``benchmarks/security_benchmark.py`` measures Agent Memory Guard's own
+detector accuracy on single writes, AMSB measures the *lifecycle* threat that
+motivates the project: a payload is planted into memory, survives a context
+reset, and is read back on a later turn where it becomes an active directive.
+
+The benchmark scores a system on what a downstream turn can actually recall
+after an attack sequence — not on whether a single write looked suspicious.
+Systems are ranked with a 0–100 resilience score and an SSL-Labs-style letter
+grade, with hard grade ceilings for catastrophic breaches.
+
+Agent Memory Guard authors this benchmark and also submits itself for grading.
+To keep the ranking honest, AMG is measured through the *same* adapter contract
+as every other system, its results carry an explicit self-submission note, and
+every score is reproducible with ``amg-bench``.
+"""
+from __future__ import annotations
+
+from agent_memory_guard.bench.adapter import (
+    MemorySystemAdapter,
+    ProbeResult,
+    RememberOutcome,
+)
+from agent_memory_guard.bench.harness import ScenarioRun, SystemReport, run_suite
+from agent_memory_guard.bench.scenarios import (
+    Scenario,
+    Severity,
+    Step,
+    default_corpus,
+)
+from agent_memory_guard.bench.scoring import Grade, Scorecard, score_report
+
+__all__ = [
+    "MemorySystemAdapter",
+    "RememberOutcome",
+    "ProbeResult",
+    "Scenario",
+    "Step",
+    "Severity",
+    "default_corpus",
+    "run_suite",
+    "ScenarioRun",
+    "SystemReport",
+    "score_report",
+    "Scorecard",
+    "Grade",
+]

agent_memory_guard-0.3.3/src/agent_memory_guard/bench/adapter.py

@@ -0,0 +1,113 @@
+"""Adapter contract every graded memory system implements.
+
+A memory system is anything an agent writes facts into and reads them back
+from on a later turn: a plain dictionary, a guarded store, or a third-party
+service such as mem0, Letta, or Zep. AMSB never talks to those systems
+directly; it talks to a :class:`MemorySystemAdapter`, so grading a new system
+means writing one small adapter and nothing else changes.
+
+The contract is deliberately tiny — ``remember``, ``recall``, ``context_reset``
+— because that is the whole of the poisoning threat surface: content goes in,
+a session boundary passes, content comes back out and steers the next turn.
+"""
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any
+
+
+class RememberOutcome(str, Enum):
+    """What a system did with an attempted write.
+
+    The benchmark scores on what ``recall`` returns, not on this value, but the
+    outcome is recorded for every step so a report can explain *how* a system
+    defended (or failed to). The four values mirror the actions an enforcing
+    guard can take; a system with no defenses only ever reports ``STORED``.
+    """
+
+    STORED = "stored"
+    """Persisted and readable back verbatim (no defense applied)."""
+
+    REDACTED = "redacted"
+    """Persisted, but the dangerous content was removed or masked first."""
+
+    QUARANTINED = "quarantined"
+    """Withheld from normal recall and flagged for review."""
+
+    BLOCKED = "blocked"
+    """Rejected outright; nothing was persisted."""
+
+
+@dataclass
+class ProbeResult:
+    """The value a later turn reads back, plus how the write was handled.
+
+    ``recalled`` is the ground truth the benchmark judges: if the attack's
+    canary survives in it, the system was breached, regardless of ``outcome``.
+    ``outcome`` is advisory reporting detail.
+    """
+
+    recalled: Any | None
+    outcome: RememberOutcome
+
+
+class MemorySystemAdapter(ABC):
+    """Uniform interface AMSB drives to grade a memory system.
+
+    Subclasses set :attr:`name` and :attr:`version` and implement the three
+    methods below. Adapters must be cheap to construct: the harness builds a
+    fresh adapter per scenario so no state leaks between attacks.
+    """
+
+    #: Stable, human-readable system name shown on the leaderboard.
+    name: str = "unnamed-system"
+    #: Version string for the graded system (not the benchmark version).
+    version: str = "0.0.0"
+    #: Set on adapters that grade the benchmark's own author, so reports can
+    #: flag the self-submission. Third-party adapters leave this False.
+    self_submission: bool = False
+
+    @abstractmethod
+    def remember(
+        self,
+        key: str,
+        value: Any,
+        *,
+        source_class: str = "external_tool",
+    ) -> RememberOutcome:
+        """Attempt to persist ``value`` under ``key``.
+
+        Args:
+            key: Memory key the agent would write to.
+            value: Content being written — for attack steps, a poisoned payload.
+            source_class: Provenance hint (``external_tool``, ``user_input``,
+                ``agent_authored``, ``system``). Systems that ignore provenance
+                may drop it; guarded systems use it for self-reinforcement and
+                trust decisions.
+
+        Returns:
+            How the system handled the write.
+        """
+
+    @abstractmethod
+    def recall(self, key: str) -> Any | None:
+        """Return what a later turn reads back for ``key`` (``None`` if absent).
+
+        This is the value the benchmark inspects for a surviving canary. A
+        system that blocked or quarantined the write should return ``None``
+        (or a value with the dangerous content removed).
+        """
+
+    def context_reset(self) -> None:
+        """Simulate a session boundary: clear working context, keep memory.
+
+        The entire point of memory poisoning is that persisted content
+        outlives the conversation that planted it. The harness calls this
+        between the attack sequence and the probe so a passing grade means the
+        system defended content that *survived a reset*, not merely content in
+        the current turn. Default: no-op, because a durable store already
+        persists across it.
+        """
+        return None

agent_memory_guard-0.3.3/src/agent_memory_guard/bench/adapters/__init__.py

@@ -0,0 +1,22 @@
+"""Adapters that plug concrete memory systems into AMSB.
+
+The baseline adapters here (an unguarded dictionary and two Agent Memory Guard
+configurations) always import cleanly and are what the committed leaderboard is
+built from. Third-party adapters live in :mod:`third_party` and import their
+target lazily, so grading mem0/Letta/Zep is opt-in and never a hard dependency.
+"""
+from __future__ import annotations
+
+from agent_memory_guard.bench.adapters.baseline import (
+    AMGHardenedAdapter,
+    AMGStrictAdapter,
+    UnguardedDictAdapter,
+    baseline_adapters,
+)
+
+__all__ = [
+    "UnguardedDictAdapter",
+    "AMGStrictAdapter",
+    "AMGHardenedAdapter",
+    "baseline_adapters",
+]