agenticdome-python-sdk 1.2.19__tar.gz → 1.2.22__tar.gz

{agenticdome_python_sdk-1.2.19 → agenticdome_python_sdk-1.2.22}/MANIFEST.in

@@ -9,7 +9,7 @@ include setup.py
 recursive-include examples *.py
 recursive-include examples *.md
 recursive-include docs *.md
-recursive-include tests *.py
+prune tests
 global-exclude __pycache__
 global-exclude *.py[cod]
 global-exclude .DS_Store

{agenticdome_python_sdk-1.2.19 → agenticdome_python_sdk-1.2.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.19
+Version: 1.2.22
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -12,7 +12,7 @@ Project-URL: MCP Integration Guide, https://github.com/agenticdome/agenticdome-p
 Project-URL: Issues, https://github.com/agenticdome/agenticdome-python-sdk/issues
 Project-URL: Examples, https://github.com/agenticdome/agenticdome-python-sdk/tree/main/examples
 Project-URL: Security, https://github.com/agenticdome/agenticdome-python-sdk/security/policy
-Keywords: agentguard,agenticdome,ai-security,agent-security,guardrails,a2a,mcp,zero-trust,runtime-security
+Keywords: action-firewall,agenticdome,ai-security,agent-security,guardrails,a2a,mcp,zero-trust,runtime-security
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Information Technology
@@ -32,20 +32,20 @@ License-File: NOTICE
 Requires-Dist: requests>=2.31.0
 Requires-Dist: urllib3>=2.0.0
 Provides-Extra: crewai
-Requires-Dist: crewai<=1.15.16,>=1.15.5; extra == "crewai"
+Requires-Dist: crewai<=1.15.17,>=1.15.5; extra == "crewai"
 Provides-Extra: redis
 Requires-Dist: redis>=4.5.0; extra == "redis"
 Provides-Extra: pop
 Requires-Dist: cryptography>=42.0.0; extra == "pop"
 Provides-Extra: pydanticai
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "pydanticai"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "pydanticai"
 Requires-Dist: anyio>=4.0.0; extra == "pydanticai"
 Provides-Extra: pydantic
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "pydantic"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "pydantic"
 Requires-Dist: anyio>=4.0.0; extra == "pydantic"
 Provides-Extra: langgraph
 Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "langgraph"
-Requires-Dist: langchain-core<=1.5.6,>=1.5.0; extra == "langgraph"
+Requires-Dist: langchain-core<=1.6.0,>=1.5.0; extra == "langgraph"
 Requires-Dist: langchain-openai==1.3.5; extra == "langgraph"
 Requires-Dist: anyio>=4.0.0; extra == "langgraph"
 Provides-Extra: microsoft
@@ -54,51 +54,51 @@ Requires-Dist: autogen-agentchat==0.7.5; extra == "autogen"
 Provides-Extra: microsoft-autogen
 Requires-Dist: autogen-agentchat==0.7.5; extra == "microsoft-autogen"
 Provides-Extra: foundry
-Requires-Dist: azure-ai-projects<=2.4.0,>=2.3.0; extra == "foundry"
+Requires-Dist: azure-ai-projects<=2.5.0,>=2.3.0; extra == "foundry"
 Requires-Dist: azure-identity==1.25.3; extra == "foundry"
 Provides-Extra: agno
 Requires-Dist: agno<=2.9.0,>=2.8.0; extra == "agno"
 Provides-Extra: openai-agents
-Requires-Dist: openai-agents<=0.21.1,>=0.18.3; extra == "openai-agents"
+Requires-Dist: openai-agents<=0.22.0,>=0.18.3; extra == "openai-agents"
 Provides-Extra: mcp
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "mcp"
 Provides-Extra: bedrock
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "bedrock"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "bedrock"
 Provides-Extra: aws-bedrock
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "aws-bedrock"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "aws-bedrock"
 Provides-Extra: llamaindex
-Requires-Dist: llama-index==0.14.23; extra == "llamaindex"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "llamaindex"
 Provides-Extra: llama-index
-Requires-Dist: llama-index==0.14.23; extra == "llama-index"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "llama-index"
 Provides-Extra: google-adk
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "google-adk"
 Provides-Extra: adk
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "adk"
 Provides-Extra: claude
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "claude"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "claude"
 Provides-Extra: claude-agent-sdk
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "claude-agent-sdk"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "claude-agent-sdk"
 Provides-Extra: smolagents
 Requires-Dist: smolagents==1.26.0; extra == "smolagents"
 Provides-Extra: all
-Requires-Dist: crewai<=1.15.16,>=1.15.5; extra == "all"
+Requires-Dist: crewai<=1.15.17,>=1.15.5; extra == "all"
 Requires-Dist: redis>=4.5.0; extra == "all"
 Requires-Dist: cryptography>=42.0.0; extra == "all"
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "all"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "all"
 Requires-Dist: anyio>=4.0.0; extra == "all"
 Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "all"
-Requires-Dist: langchain-core<=1.5.6,>=1.5.0; extra == "all"
+Requires-Dist: langchain-core<=1.6.0,>=1.5.0; extra == "all"
 Requires-Dist: langchain-openai==1.3.5; extra == "all"
 Requires-Dist: autogen-agentchat==0.7.5; extra == "all"
 Requires-Dist: agno<=2.9.0,>=2.8.0; extra == "all"
-Requires-Dist: azure-ai-projects<=2.4.0,>=2.3.0; extra == "all"
+Requires-Dist: azure-ai-projects<=2.5.0,>=2.3.0; extra == "all"
 Requires-Dist: azure-identity==1.25.3; extra == "all"
-Requires-Dist: openai-agents<=0.21.1,>=0.18.3; extra == "all"
+Requires-Dist: openai-agents<=0.22.0,>=0.18.3; extra == "all"
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "all"
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "all"
-Requires-Dist: llama-index==0.14.23; extra == "all"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "all"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "all"
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "all"
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "all"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "all"
 Requires-Dist: smolagents==1.26.0; extra == "all"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0.0; extra == "dev"
@@ -171,14 +171,17 @@ keeps source code on your machine:
 
 ```bash
 agenticdome init
-agenticdome verify --run-tests --output .agenticdome/verification.json
+agenticdome inspect --output agenticdome-inspection.json
 ```
 
-`init` writes the secret-free inspection and local configuration. `verify` is
-required before production because it rechecks the discovered boundaries,
-runs harmless allowed/blocked cases and, with `--run-tests`, runs detected
-application tests. If you want a suggested patch, run `agenticdome scaffold`;
-that step is optional and writes an unapplied patch for review.
+`init` writes the secret-free inspection and local configuration. For the
+certified onboarding path, obtain the assigned sidecar and a dedicated
+`integration_copilot` key, run the tenant-bound `agenticdome plan`, attach
+and test the selected boundaries, then run
+`agenticdome verify --run-tests --output .agenticdome/verification.json`.
+The private plan is required because production verification consumes its
+signed, catalog-bound semantic analysis. `agenticdome scaffold` remains
+optional and writes an unapplied patch for review.
 
 When `.agenticdome/inspection.json` is imported into Developer Integration,
 the Control Panel adds its detected frameworks to the workload. Frameworks,
@@ -772,9 +775,9 @@ from agenticdome_sdk.crewai import (
     DecisionTokenStore,
     InMemoryDecisionTokenStore,
     RedisDecisionTokenStore,
-    AgenticDome_before_tool_call,
-    AgenticDome_after_tool_call,
-    AgenticDome_before_llm_call,
+    agenticdome_before_tool_call,
+    agenticdome_after_tool_call,
+    agenticdome_before_llm_call,
     sanitize_streaming_response,
     attach_firewall,
     unregister_firewall,
@@ -2287,7 +2290,7 @@ from agenticdome_sdk.aws_bedrock import (
 
 ### MCP Host / Gateway
 
-The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and sanitize tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it works with any MCP host, proxy, gateway, or router.
+The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and review configured tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it can be wired into an application-controlled MCP host, proxy, gateway, or router without replacing its transport.
 
 Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/mcp-integration.md), including the network-free allowed, blocked, and poisoned-result rehearsal.
 
@@ -2295,6 +2298,8 @@ Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://gi
 pip install "agenticdome-python-sdk[mcp]"
 ```
 
+**MCP package compatibility:** the `[mcp]` extra currently installs the externally certified PyPI range `mcp>=1.26.0,<=1.28.1`. That is the supported range of the third-party `mcp` package, not the version of AgenticDome's SDK. MCP 2.0 removed the certified `mcp.server.fastmcp` import surface, and CrewAI 1.15.5 declares `mcp~=1.28.1` for combined installs. Keep the ceiling until an isolated MCP 2.x certification passes the native imports, adapter checks, preserved 1.x floor, and package gates. The AgenticDome firewall itself is plain-JSON-RPC and dependency-light, but installing the base SDK beside an independently managed MCP 2.x transport does not constitute a formally certified MCP 2.x support claim.
+
 **Wrap the forwarding boundary** — the full host flow is `JSON-RPC request → rate limit / upstream prompt screen → method authorization → optional delegation-token verification → third-party MCP server → list filtering / result sanitization → client`:
 
 ```python
@@ -2357,7 +2362,7 @@ await firewall.authorize_manager_handoff(
 <details>
 <summary>MCP capabilities, configuration, notes, and imports</summary>
 
-Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · fail-closed/fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
+Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · configurable request/preflight fail-closed or fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
 
 ```bash
 export AGENTICDOME_PLATFORM="mcp"
@@ -2381,7 +2386,7 @@ export AGENTICDOME_MCP_RATE_LIMIT_PER_MINUTE="0"
 # export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:mcp:handoff"
 ```
 
-Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects the local host boundary and returned result; it cannot inspect code inside a remote third-party MCP server you do not control. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
+Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects only the routed local boundary and configured returned-result paths; it cannot inspect code inside a remote third-party MCP server you do not control. `forward_with_firewall()` enforces policy blocks, but currently returns the original response after an unexpected non-policy result-sanitization error. Applications requiring fail-closed output handling must catch and block review failures explicitly. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
 
 ```python
 from agenticdome_sdk.mcp_host import (
@@ -2405,9 +2410,9 @@ Use the core client when you own the runtime loop or have a custom gateway — A
 **End-to-end example** — prompt screen, tool authorization, execution, output review:
 
 ```python
-from agenticdome_sdk.client import AgentGuardClient
+from agenticdome_sdk.client import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     api_base="https://demo-sidecar.agenticdome.io",
     api_key="your-api-key",
     tenant_id="your-tenant-id",
@@ -2574,9 +2579,9 @@ client.report_incident(
 For high-impact tools, authorise at the last responsible moment and bind the decision to the real destination, HTTP method, tool version/digest, and workload identity. The sidecar returns a short-lived, single-use execution receipt; attach it to the actual outbound request that traverses the AgenticDome enforcement gateway.
 
 ```python
-from agenticdome_sdk import AgentGuardClient
+from agenticdome_sdk import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     "https://your-sidecar.example.com",
     execution_broker_mode="enforce",
 )

{agenticdome_python_sdk-1.2.19 → agenticdome_python_sdk-1.2.22}/README.md

@@ -59,14 +59,17 @@ keeps source code on your machine:
 
 ```bash
 agenticdome init
-agenticdome verify --run-tests --output .agenticdome/verification.json
+agenticdome inspect --output agenticdome-inspection.json
 ```
 
-`init` writes the secret-free inspection and local configuration. `verify` is
-required before production because it rechecks the discovered boundaries,
-runs harmless allowed/blocked cases and, with `--run-tests`, runs detected
-application tests. If you want a suggested patch, run `agenticdome scaffold`;
-that step is optional and writes an unapplied patch for review.
+`init` writes the secret-free inspection and local configuration. For the
+certified onboarding path, obtain the assigned sidecar and a dedicated
+`integration_copilot` key, run the tenant-bound `agenticdome plan`, attach
+and test the selected boundaries, then run
+`agenticdome verify --run-tests --output .agenticdome/verification.json`.
+The private plan is required because production verification consumes its
+signed, catalog-bound semantic analysis. `agenticdome scaffold` remains
+optional and writes an unapplied patch for review.
 
 When `.agenticdome/inspection.json` is imported into Developer Integration,
 the Control Panel adds its detected frameworks to the workload. Frameworks,
@@ -660,9 +663,9 @@ from agenticdome_sdk.crewai import (
     DecisionTokenStore,
     InMemoryDecisionTokenStore,
     RedisDecisionTokenStore,
-    AgenticDome_before_tool_call,
-    AgenticDome_after_tool_call,
-    AgenticDome_before_llm_call,
+    agenticdome_before_tool_call,
+    agenticdome_after_tool_call,
+    agenticdome_before_llm_call,
     sanitize_streaming_response,
     attach_firewall,
     unregister_firewall,
@@ -2175,7 +2178,7 @@ from agenticdome_sdk.aws_bedrock import (
 
 ### MCP Host / Gateway
 
-The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and sanitize tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it works with any MCP host, proxy, gateway, or router.
+The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and review configured tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it can be wired into an application-controlled MCP host, proxy, gateway, or router without replacing its transport.
 
 Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/mcp-integration.md), including the network-free allowed, blocked, and poisoned-result rehearsal.
 
@@ -2183,6 +2186,8 @@ Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://gi
 pip install "agenticdome-python-sdk[mcp]"
 ```
 
+**MCP package compatibility:** the `[mcp]` extra currently installs the externally certified PyPI range `mcp>=1.26.0,<=1.28.1`. That is the supported range of the third-party `mcp` package, not the version of AgenticDome's SDK. MCP 2.0 removed the certified `mcp.server.fastmcp` import surface, and CrewAI 1.15.5 declares `mcp~=1.28.1` for combined installs. Keep the ceiling until an isolated MCP 2.x certification passes the native imports, adapter checks, preserved 1.x floor, and package gates. The AgenticDome firewall itself is plain-JSON-RPC and dependency-light, but installing the base SDK beside an independently managed MCP 2.x transport does not constitute a formally certified MCP 2.x support claim.
+
 **Wrap the forwarding boundary** — the full host flow is `JSON-RPC request → rate limit / upstream prompt screen → method authorization → optional delegation-token verification → third-party MCP server → list filtering / result sanitization → client`:
 
 ```python
@@ -2245,7 +2250,7 @@ await firewall.authorize_manager_handoff(
 <details>
 <summary>MCP capabilities, configuration, notes, and imports</summary>
 
-Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · fail-closed/fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
+Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · configurable request/preflight fail-closed or fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
 
 ```bash
 export AGENTICDOME_PLATFORM="mcp"
@@ -2269,7 +2274,7 @@ export AGENTICDOME_MCP_RATE_LIMIT_PER_MINUTE="0"
 # export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:mcp:handoff"
 ```
 
-Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects the local host boundary and returned result; it cannot inspect code inside a remote third-party MCP server you do not control. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
+Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects only the routed local boundary and configured returned-result paths; it cannot inspect code inside a remote third-party MCP server you do not control. `forward_with_firewall()` enforces policy blocks, but currently returns the original response after an unexpected non-policy result-sanitization error. Applications requiring fail-closed output handling must catch and block review failures explicitly. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
 
 ```python
 from agenticdome_sdk.mcp_host import (
@@ -2293,9 +2298,9 @@ Use the core client when you own the runtime loop or have a custom gateway — A
 **End-to-end example** — prompt screen, tool authorization, execution, output review:
 
 ```python
-from agenticdome_sdk.client import AgentGuardClient
+from agenticdome_sdk.client import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     api_base="https://demo-sidecar.agenticdome.io",
     api_key="your-api-key",
     tenant_id="your-tenant-id",
@@ -2462,9 +2467,9 @@ client.report_incident(
 For high-impact tools, authorise at the last responsible moment and bind the decision to the real destination, HTTP method, tool version/digest, and workload identity. The sidecar returns a short-lived, single-use execution receipt; attach it to the actual outbound request that traverses the AgenticDome enforcement gateway.
 
 ```python
-from agenticdome_sdk import AgentGuardClient
+from agenticdome_sdk import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     "https://your-sidecar.example.com",
     execution_broker_mode="enforce",
 )

{agenticdome_python_sdk-1.2.19 → agenticdome_python_sdk-1.2.22}/agenticdome_python_sdk.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenticdome-python-sdk
-Version: 1.2.19
+Version: 1.2.22
 Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
 Author: AgenticDome
 License-Expression: Apache-2.0
@@ -12,7 +12,7 @@ Project-URL: MCP Integration Guide, https://github.com/agenticdome/agenticdome-p
 Project-URL: Issues, https://github.com/agenticdome/agenticdome-python-sdk/issues
 Project-URL: Examples, https://github.com/agenticdome/agenticdome-python-sdk/tree/main/examples
 Project-URL: Security, https://github.com/agenticdome/agenticdome-python-sdk/security/policy
-Keywords: agentguard,agenticdome,ai-security,agent-security,guardrails,a2a,mcp,zero-trust,runtime-security
+Keywords: action-firewall,agenticdome,ai-security,agent-security,guardrails,a2a,mcp,zero-trust,runtime-security
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Information Technology
@@ -32,20 +32,20 @@ License-File: NOTICE
 Requires-Dist: requests>=2.31.0
 Requires-Dist: urllib3>=2.0.0
 Provides-Extra: crewai
-Requires-Dist: crewai<=1.15.16,>=1.15.5; extra == "crewai"
+Requires-Dist: crewai<=1.15.17,>=1.15.5; extra == "crewai"
 Provides-Extra: redis
 Requires-Dist: redis>=4.5.0; extra == "redis"
 Provides-Extra: pop
 Requires-Dist: cryptography>=42.0.0; extra == "pop"
 Provides-Extra: pydanticai
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "pydanticai"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "pydanticai"
 Requires-Dist: anyio>=4.0.0; extra == "pydanticai"
 Provides-Extra: pydantic
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "pydantic"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "pydantic"
 Requires-Dist: anyio>=4.0.0; extra == "pydantic"
 Provides-Extra: langgraph
 Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "langgraph"
-Requires-Dist: langchain-core<=1.5.6,>=1.5.0; extra == "langgraph"
+Requires-Dist: langchain-core<=1.6.0,>=1.5.0; extra == "langgraph"
 Requires-Dist: langchain-openai==1.3.5; extra == "langgraph"
 Requires-Dist: anyio>=4.0.0; extra == "langgraph"
 Provides-Extra: microsoft
@@ -54,51 +54,51 @@ Requires-Dist: autogen-agentchat==0.7.5; extra == "autogen"
 Provides-Extra: microsoft-autogen
 Requires-Dist: autogen-agentchat==0.7.5; extra == "microsoft-autogen"
 Provides-Extra: foundry
-Requires-Dist: azure-ai-projects<=2.4.0,>=2.3.0; extra == "foundry"
+Requires-Dist: azure-ai-projects<=2.5.0,>=2.3.0; extra == "foundry"
 Requires-Dist: azure-identity==1.25.3; extra == "foundry"
 Provides-Extra: agno
 Requires-Dist: agno<=2.9.0,>=2.8.0; extra == "agno"
 Provides-Extra: openai-agents
-Requires-Dist: openai-agents<=0.21.1,>=0.18.3; extra == "openai-agents"
+Requires-Dist: openai-agents<=0.22.0,>=0.18.3; extra == "openai-agents"
 Provides-Extra: mcp
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "mcp"
 Provides-Extra: bedrock
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "bedrock"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "bedrock"
 Provides-Extra: aws-bedrock
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "aws-bedrock"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "aws-bedrock"
 Provides-Extra: llamaindex
-Requires-Dist: llama-index==0.14.23; extra == "llamaindex"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "llamaindex"
 Provides-Extra: llama-index
-Requires-Dist: llama-index==0.14.23; extra == "llama-index"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "llama-index"
 Provides-Extra: google-adk
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "google-adk"
 Provides-Extra: adk
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "adk"
 Provides-Extra: claude
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "claude"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "claude"
 Provides-Extra: claude-agent-sdk
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "claude-agent-sdk"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "claude-agent-sdk"
 Provides-Extra: smolagents
 Requires-Dist: smolagents==1.26.0; extra == "smolagents"
 Provides-Extra: all
-Requires-Dist: crewai<=1.15.16,>=1.15.5; extra == "all"
+Requires-Dist: crewai<=1.15.17,>=1.15.5; extra == "all"
 Requires-Dist: redis>=4.5.0; extra == "all"
 Requires-Dist: cryptography>=42.0.0; extra == "all"
-Requires-Dist: pydantic-ai<=2.31.1,>=2.16.0; extra == "all"
+Requires-Dist: pydantic-ai<=2.33.0,>=2.16.0; extra == "all"
 Requires-Dist: anyio>=4.0.0; extra == "all"
 Requires-Dist: langgraph<=1.2.11,>=1.2.9; extra == "all"
-Requires-Dist: langchain-core<=1.5.6,>=1.5.0; extra == "all"
+Requires-Dist: langchain-core<=1.6.0,>=1.5.0; extra == "all"
 Requires-Dist: langchain-openai==1.3.5; extra == "all"
 Requires-Dist: autogen-agentchat==0.7.5; extra == "all"
 Requires-Dist: agno<=2.9.0,>=2.8.0; extra == "all"
-Requires-Dist: azure-ai-projects<=2.4.0,>=2.3.0; extra == "all"
+Requires-Dist: azure-ai-projects<=2.5.0,>=2.3.0; extra == "all"
 Requires-Dist: azure-identity==1.25.3; extra == "all"
-Requires-Dist: openai-agents<=0.21.1,>=0.18.3; extra == "all"
+Requires-Dist: openai-agents<=0.22.0,>=0.18.3; extra == "all"
 Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "all"
-Requires-Dist: boto3<=1.43.73,>=1.43.54; extra == "all"
-Requires-Dist: llama-index==0.14.23; extra == "all"
+Requires-Dist: boto3<=1.43.78,>=1.43.54; extra == "all"
+Requires-Dist: llama-index<=0.14.24,>=0.14.23; extra == "all"
 Requires-Dist: google-adk<=2.7.1,>=2.5.0; extra == "all"
-Requires-Dist: claude-agent-sdk<=0.2.139,>=0.2.126; extra == "all"
+Requires-Dist: claude-agent-sdk<=0.2.144,>=0.2.126; extra == "all"
 Requires-Dist: smolagents==1.26.0; extra == "all"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0.0; extra == "dev"
@@ -171,14 +171,17 @@ keeps source code on your machine:
 
 ```bash
 agenticdome init
-agenticdome verify --run-tests --output .agenticdome/verification.json
+agenticdome inspect --output agenticdome-inspection.json
 ```
 
-`init` writes the secret-free inspection and local configuration. `verify` is
-required before production because it rechecks the discovered boundaries,
-runs harmless allowed/blocked cases and, with `--run-tests`, runs detected
-application tests. If you want a suggested patch, run `agenticdome scaffold`;
-that step is optional and writes an unapplied patch for review.
+`init` writes the secret-free inspection and local configuration. For the
+certified onboarding path, obtain the assigned sidecar and a dedicated
+`integration_copilot` key, run the tenant-bound `agenticdome plan`, attach
+and test the selected boundaries, then run
+`agenticdome verify --run-tests --output .agenticdome/verification.json`.
+The private plan is required because production verification consumes its
+signed, catalog-bound semantic analysis. `agenticdome scaffold` remains
+optional and writes an unapplied patch for review.
 
 When `.agenticdome/inspection.json` is imported into Developer Integration,
 the Control Panel adds its detected frameworks to the workload. Frameworks,
@@ -772,9 +775,9 @@ from agenticdome_sdk.crewai import (
     DecisionTokenStore,
     InMemoryDecisionTokenStore,
     RedisDecisionTokenStore,
-    AgenticDome_before_tool_call,
-    AgenticDome_after_tool_call,
-    AgenticDome_before_llm_call,
+    agenticdome_before_tool_call,
+    agenticdome_after_tool_call,
+    agenticdome_before_llm_call,
     sanitize_streaming_response,
     attach_firewall,
     unregister_firewall,
@@ -2287,7 +2290,7 @@ from agenticdome_sdk.aws_bedrock import (
 
 ### MCP Host / Gateway
 
-The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and sanitize tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it works with any MCP host, proxy, gateway, or router.
+The host is the right place to protect MCP: it can inspect `tools/call` requests before side effects happen and review configured tool results before they return to the planner, agent, or client. The adapter accepts plain JSON-RPC request dictionaries, so it can be wired into an application-controlled MCP host, proxy, gateway, or router without replacing its transport.
 
 Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/mcp-integration.md), including the network-free allowed, blocked, and poisoned-result rehearsal.
 
@@ -2295,6 +2298,8 @@ Start with the dedicated [MCP Host and Gateway Action Firewall guide](https://gi
 pip install "agenticdome-python-sdk[mcp]"
 ```
 
+**MCP package compatibility:** the `[mcp]` extra currently installs the externally certified PyPI range `mcp>=1.26.0,<=1.28.1`. That is the supported range of the third-party `mcp` package, not the version of AgenticDome's SDK. MCP 2.0 removed the certified `mcp.server.fastmcp` import surface, and CrewAI 1.15.5 declares `mcp~=1.28.1` for combined installs. Keep the ceiling until an isolated MCP 2.x certification passes the native imports, adapter checks, preserved 1.x floor, and package gates. The AgenticDome firewall itself is plain-JSON-RPC and dependency-light, but installing the base SDK beside an independently managed MCP 2.x transport does not constitute a formally certified MCP 2.x support claim.
+
 **Wrap the forwarding boundary** — the full host flow is `JSON-RPC request → rate limit / upstream prompt screen → method authorization → optional delegation-token verification → third-party MCP server → list filtering / result sanitization → client`:
 
 ```python
@@ -2357,7 +2362,7 @@ await firewall.authorize_manager_handoff(
 <details>
 <summary>MCP capabilities, configuration, notes, and imports</summary>
 
-Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · fail-closed/fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
+Supports: optional upstream prompt screening from host context · `tools/call` authorization via `mcp_guardrail_validate()` · authorization for tool, resource, prompt and sampling methods · tool-list filtering according to policy · resource, prompt, sampling, tool, and streaming-output sanitization · delegated verification through public handoff methods · per-server policy context · sanitized business-argument forwarding · size limits, rate limiting and audit logging · Mesh output sanitization for supported MCP result shapes · configurable request/preflight fail-closed or fail-open behavior via `AGENTICDOME_FAIL_CLOSED`.
 
 ```bash
 export AGENTICDOME_PLATFORM="mcp"
@@ -2381,7 +2386,7 @@ export AGENTICDOME_MCP_RATE_LIMIT_PER_MINUTE="0"
 # export AGENTICDOME_REDIS_KEY_PREFIX="AgenticDome:mcp:handoff"
 ```
 
-Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects the local host boundary and returned result; it cannot inspect code inside a remote third-party MCP server you do not control. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
+Notes: call `preflight_request()` or `forward_with_firewall()` in the host, gateway, proxy, or router that forwards JSON-RPC requests — env config alone does not intercept MCP traffic. Disable individual protections with the corresponding `AGENTICDOME_MCP_PROTECT_*` setting when a simple host needs passthrough behavior. AgenticDome protects only the routed local boundary and configured returned-result paths; it cannot inspect code inside a remote third-party MCP server you do not control. `forward_with_firewall()` enforces policy blocks, but currently returns the original response after an unexpected non-policy result-sanitization error. Applications requiring fail-closed output handling must catch and block review failures explicitly. Pass `mcp_server_id`, `mcp_server_url`, `mcp_server_vendor`, and trust metadata in `context` for per-server policy decisions. Use stable `session_id` values; set `AGENTICDOME_REQUIRE_SESSION_ID=true` when every host request should be traceable.
 
 ```python
 from agenticdome_sdk.mcp_host import (
@@ -2405,9 +2410,9 @@ Use the core client when you own the runtime loop or have a custom gateway — A
 **End-to-end example** — prompt screen, tool authorization, execution, output review:
 
 ```python
-from agenticdome_sdk.client import AgentGuardClient
+from agenticdome_sdk.client import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     api_base="https://demo-sidecar.agenticdome.io",
     api_key="your-api-key",
     tenant_id="your-tenant-id",
@@ -2574,9 +2579,9 @@ client.report_incident(
 For high-impact tools, authorise at the last responsible moment and bind the decision to the real destination, HTTP method, tool version/digest, and workload identity. The sidecar returns a short-lived, single-use execution receipt; attach it to the actual outbound request that traverses the AgenticDome enforcement gateway.
 
 ```python
-from agenticdome_sdk import AgentGuardClient
+from agenticdome_sdk import AgenticDomeClient
 
-client = AgentGuardClient(
+client = AgenticDomeClient(
     "https://your-sidecar.example.com",
     execution_broker_mode="enforce",
 )

{agenticdome_python_sdk-1.2.19 → agenticdome_python_sdk-1.2.22}/agenticdome_python_sdk.egg-info/SOURCES.txt

@@ -20,9 +20,12 @@ agenticdome_sdk/autogen.py
 agenticdome_sdk/aws_bedrock.py
 agenticdome_sdk/claude.py
 agenticdome_sdk/client.py
+agenticdome_sdk/copilot_ir.py
+agenticdome_sdk/copilot_ir_collector.cjs
 agenticdome_sdk/crewai.py
 agenticdome_sdk/demo.py
 agenticdome_sdk/google_adk.py
+agenticdome_sdk/hook_catalog.py
 agenticdome_sdk/identity.py
 agenticdome_sdk/langgraph.py
 agenticdome_sdk/llamaindex.py
@@ -77,26 +80,4 @@ examples/frameworks/microsoft_agent_framework.py
 examples/frameworks/microsoft_ai_foundry.py
 examples/frameworks/openai_agents.py
 examples/frameworks/pydanticai.py
-examples/frameworks/smolagents.py
-tests/test_agno_integration.py
-tests/test_attack_demo.py
-tests/test_autogen_integration.py
-tests/test_aws_bedrock_integration.py
-tests/test_claude_integration.py
-tests/test_client.py
-tests/test_crewai_integration.py
-tests/test_execution_broker.py
-tests/test_framework_guides.py
-tests/test_google_adk_integration.py
-tests/test_identity_context.py
-tests/test_langgraph_integration.py
-tests/test_llamaindex_integration.py
-tests/test_local_simulation.py
-tests/test_mcp_host_integration.py
-tests/test_mcp_launch_example.py
-tests/test_microsoft_agent_framework_integration.py
-tests/test_microsoft_ai_foundry_integration.py
-tests/test_onboarding_cli.py
-tests/test_openai_agents_integration.py
-tests/test_pydanticai_integration.py
-tests/test_smolagents_integration.py
+examples/frameworks/smolagents.py