agenticdome-python-sdk 1.2.1__py3-none-any.whl → 1.2.3__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. {agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/METADATA +290 -18
  2. {agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/RECORD +9 -5
  3. agenticdome_sdk/_framework_firewall.py +614 -0
  4. agenticdome_sdk/autogen.py +709 -0
  5. agenticdome_sdk/claude.py +420 -0
  6. agenticdome_sdk/smolagents.py +488 -0
  7. {agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/WHEEL +0 -0
  8. {agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/licenses/LICENSE +0 -0
  9. {agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/top_level.txt +0 -0
{agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: agenticdome-python-sdk
3
- Version: 1.2.1
3
+ Version: 1.2.3
4
4
  Summary: Official Python SDK for AgenticDome security guardrails, DLP, tool authorization, and multi-agent delegation enforcement.
5
5
  Author: AgenticDome
6
6
  License: Proprietary
@@ -27,35 +27,40 @@ License-File: LICENSE
27
27
  Requires-Dist: requests>=2.31.0
28
28
  Requires-Dist: urllib3>=2.0.0
29
29
  Provides-Extra: crewai
30
- Requires-Dist: crewai==1.15.5; extra == "crewai"
30
+ Requires-Dist: crewai<=1.15.6,>=1.15.5; extra == "crewai"
31
31
  Provides-Extra: redis
32
32
  Requires-Dist: redis>=4.5.0; extra == "redis"
33
33
  Provides-Extra: pop
34
34
  Requires-Dist: cryptography>=42.0.0; extra == "pop"
35
35
  Provides-Extra: pydanticai
36
- Requires-Dist: pydantic-ai==2.15.0; extra == "pydanticai"
36
+ Requires-Dist: pydantic-ai<=2.18.0,>=2.16.0; extra == "pydanticai"
37
37
  Requires-Dist: anyio>=4.0.0; extra == "pydanticai"
38
38
  Provides-Extra: pydantic
39
- Requires-Dist: pydantic-ai==2.15.0; extra == "pydantic"
39
+ Requires-Dist: pydantic-ai<=2.18.0,>=2.16.0; extra == "pydantic"
40
40
  Requires-Dist: anyio>=4.0.0; extra == "pydantic"
41
41
  Provides-Extra: langgraph
42
42
  Requires-Dist: langgraph==1.2.9; extra == "langgraph"
43
- Requires-Dist: langchain-core==1.5.0; extra == "langgraph"
43
+ Requires-Dist: langchain-core<=1.5.1,>=1.5.0; extra == "langgraph"
44
+ Requires-Dist: langchain-openai==1.3.5; extra == "langgraph"
44
45
  Requires-Dist: anyio>=4.0.0; extra == "langgraph"
45
46
  Provides-Extra: microsoft
47
+ Provides-Extra: autogen
48
+ Requires-Dist: autogen-agentchat==0.7.5; extra == "autogen"
49
+ Provides-Extra: microsoft-autogen
50
+ Requires-Dist: autogen-agentchat==0.7.5; extra == "microsoft-autogen"
46
51
  Provides-Extra: foundry
47
52
  Requires-Dist: azure-ai-projects==2.3.0; extra == "foundry"
48
53
  Requires-Dist: azure-identity==1.25.3; extra == "foundry"
49
54
  Provides-Extra: agno
50
- Requires-Dist: agno==2.8.0; extra == "agno"
55
+ Requires-Dist: agno<=2.8.3,>=2.8.0; extra == "agno"
51
56
  Provides-Extra: openai-agents
52
57
  Requires-Dist: openai-agents==0.18.3; extra == "openai-agents"
53
58
  Provides-Extra: mcp
54
59
  Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "mcp"
55
60
  Provides-Extra: bedrock
56
- Requires-Dist: boto3==1.43.53; extra == "bedrock"
61
+ Requires-Dist: boto3<=1.43.56,>=1.43.54; extra == "bedrock"
57
62
  Provides-Extra: aws-bedrock
58
- Requires-Dist: boto3==1.43.53; extra == "aws-bedrock"
63
+ Requires-Dist: boto3<=1.43.56,>=1.43.54; extra == "aws-bedrock"
59
64
  Provides-Extra: llamaindex
60
65
  Requires-Dist: llama-index==0.14.23; extra == "llamaindex"
61
66
  Provides-Extra: llama-index
@@ -64,22 +69,32 @@ Provides-Extra: google-adk
64
69
  Requires-Dist: google-adk==2.5.0; extra == "google-adk"
65
70
  Provides-Extra: adk
66
71
  Requires-Dist: google-adk==2.5.0; extra == "adk"
72
+ Provides-Extra: claude
73
+ Requires-Dist: claude-agent-sdk<=0.2.128,>=0.2.126; extra == "claude"
74
+ Provides-Extra: claude-agent-sdk
75
+ Requires-Dist: claude-agent-sdk<=0.2.128,>=0.2.126; extra == "claude-agent-sdk"
76
+ Provides-Extra: smolagents
77
+ Requires-Dist: smolagents==1.26.0; extra == "smolagents"
67
78
  Provides-Extra: all
68
- Requires-Dist: crewai==1.15.5; extra == "all"
79
+ Requires-Dist: crewai<=1.15.6,>=1.15.5; extra == "all"
69
80
  Requires-Dist: redis>=4.5.0; extra == "all"
70
81
  Requires-Dist: cryptography>=42.0.0; extra == "all"
71
- Requires-Dist: pydantic-ai==2.15.0; extra == "all"
82
+ Requires-Dist: pydantic-ai<=2.18.0,>=2.16.0; extra == "all"
72
83
  Requires-Dist: anyio>=4.0.0; extra == "all"
73
84
  Requires-Dist: langgraph==1.2.9; extra == "all"
74
- Requires-Dist: langchain-core==1.5.0; extra == "all"
75
- Requires-Dist: agno==2.8.0; extra == "all"
85
+ Requires-Dist: langchain-core<=1.5.1,>=1.5.0; extra == "all"
86
+ Requires-Dist: langchain-openai==1.3.5; extra == "all"
87
+ Requires-Dist: autogen-agentchat==0.7.5; extra == "all"
88
+ Requires-Dist: agno<=2.8.3,>=2.8.0; extra == "all"
76
89
  Requires-Dist: azure-ai-projects==2.3.0; extra == "all"
77
90
  Requires-Dist: azure-identity==1.25.3; extra == "all"
78
91
  Requires-Dist: openai-agents==0.18.3; extra == "all"
79
92
  Requires-Dist: mcp<=1.28.1,>=1.26.0; extra == "all"
80
- Requires-Dist: boto3==1.43.53; extra == "all"
93
+ Requires-Dist: boto3<=1.43.56,>=1.43.54; extra == "all"
81
94
  Requires-Dist: llama-index==0.14.23; extra == "all"
82
95
  Requires-Dist: google-adk==2.5.0; extra == "all"
96
+ Requires-Dist: claude-agent-sdk<=0.2.128,>=0.2.126; extra == "all"
97
+ Requires-Dist: smolagents==1.26.0; extra == "all"
83
98
  Provides-Extra: dev
84
99
  Requires-Dist: pytest>=8.0.0; extra == "dev"
85
100
  Requires-Dist: tomli>=2.0.0; python_version < "3.11" and extra == "dev"
@@ -99,7 +114,7 @@ Dynamic: license-file
99
114
 
100
115
  `agenticdome-python-sdk` is the official Python SDK and middleware package for [AgenticDome](https://agenticdome.io). It enforces deterministic security controls at every boundary your agents cross — prompt ingress, tool execution, agent-to-agent handoffs, and output egress — backed by the AgenticDome central policy plane.
101
116
 
102
- **One security pattern, twelve runtimes:** CrewAI · PydanticAI · LangGraph/LangChain · Microsoft Agent Framework · Microsoft AI Foundry · OpenAI Agents SDK · Agno · Google ADK · LlamaIndex · AWS Bedrock · MCP hosts/gateways · custom Python.
117
+ **One security pattern, fifteen runtimes:** CrewAI · PydanticAI · LangGraph/LangChain · Microsoft Agent Framework · Microsoft AutoGen · Microsoft AI Foundry · OpenAI Agents SDK · Claude Agent SDK · Hugging Face smolagents · Agno · Google ADK · LlamaIndex · AWS Bedrock · MCP hosts/gateways · custom Python.
103
118
 
104
119
  ```python
105
120
  # The 30-second version: block a prompt-injected refund before it executes.
@@ -121,7 +136,7 @@ result = crew.kickoff() # hostile prompts, unsafe tools, and rogue
121
136
  5. [Configuration](#configuration)
122
137
  6. [Choosing Your Integration Point](#choosing-your-integration-point)
123
138
  7. [Framework Integrations](#framework-integrations)
124
- - [CrewAI](#crewai) · [PydanticAI](#pydanticai) · [LangGraph](#langgraph) · [Microsoft Agent Framework](#microsoft-agent-framework) · [Microsoft AI Foundry](#microsoft-ai-foundry) · [OpenAI Agents SDK](#openai-agents-sdk) · [Agno](#agno) · [Google ADK](#google-adk) · [LlamaIndex](#llamaindex) · [AWS Bedrock](#aws-bedrock) · [MCP Host / Gateway](#mcp-host--gateway)
139
+ - [CrewAI](#crewai) · [PydanticAI](#pydanticai) · [LangGraph](#langgraph) · [Microsoft Agent Framework](#microsoft-agent-framework) · [Microsoft AutoGen](#microsoft-autogen) · [Microsoft AI Foundry](#microsoft-ai-foundry) · [OpenAI Agents SDK](#openai-agents-sdk) · [Agno](#agno) · [Google ADK](#google-adk) · [LlamaIndex](#llamaindex) · [AWS Bedrock](#aws-bedrock) · [MCP Host / Gateway](#mcp-host--gateway)
125
140
  8. [Core SDK Client (Custom Runtimes)](#core-sdk-client-custom-runtimes)
126
141
  9. [Production Deployment](#production-deployment)
127
142
  10. [Package Build and Verification](#package-build-and-verification)
@@ -266,6 +281,8 @@ result = crew.kickoff()
266
281
 
267
282
  ```bash
268
283
  python examples/attack_demo.py --framework crewai --scenario refund_hijack
284
+ python examples/attack_demo.py --framework claude --scenario metadata_exfil
285
+ python examples/attack_demo.py --framework smolagents --scenario generated_code_exfil
269
286
  ```
270
287
 
271
288
  ---
@@ -284,8 +301,11 @@ pip install agenticdome-python-sdk
284
301
  | PydanticAI | `pip install "agenticdome-python-sdk[pydanticai]"` |
285
302
  | LangGraph / LangChain | `pip install "agenticdome-python-sdk[langgraph]"` |
286
303
  | Microsoft Agent Framework | `pip install "agenticdome-python-sdk[microsoft]"` |
304
+ | Microsoft AutoGen AgentChat / Core (Python 3.10+) | `pip install "agenticdome-python-sdk[autogen]"` |
287
305
  | Microsoft AI Foundry | `pip install "agenticdome-python-sdk[foundry]"` |
288
306
  | OpenAI Agents SDK | `pip install "agenticdome-python-sdk[openai-agents]"` |
307
+ | Anthropic Claude Agent SDK | `pip install "agenticdome-python-sdk[claude]"` |
308
+ | Hugging Face smolagents | `pip install "agenticdome-python-sdk[smolagents]"` |
289
309
  | Agno | `pip install "agenticdome-python-sdk[agno]"` |
290
310
  | Google ADK | `pip install "agenticdome-python-sdk[google-adk]"` |
291
311
  | LlamaIndex | `pip install "agenticdome-python-sdk[llamaindex]"` |
@@ -297,6 +317,12 @@ pip install agenticdome-python-sdk
297
317
 
298
318
  Some adapters are dependency-light at import time: Google ADK, LlamaIndex, Bedrock, MCP, and Microsoft helpers can wrap local boundaries without forcing one exact runtime stack. Install the framework packages your application actually uses.
299
319
 
320
+ ### Framework-version compatibility
321
+
322
+ AgenticDome supports framework versions only inside the range certified by the SDK Harness. When an upstream framework release appears, **Upgrade & Certify** keeps the existing certified version as the compatibility floor, tests the new release as the ceiling, and publishes an inclusive dependency range such as `framework>=floor,<=ceiling` only when both endpoints pass the adapter and firewall release gates. Multi-package integrations such as LangGraph/LangChain are also retested at their complete certified floor set.
323
+
324
+ This means upgrading support for the latest framework does not silently drop customers on the previously certified version. Versions below the displayed certified floor are not claimed as supported until they are tested. Customers managing framework dependencies themselves may install the core SDK without an extra, but their framework version must still be inside the certified range for a production support claim.
325
+
300
326
  ---
301
327
 
302
328
  ## Configuration
@@ -394,7 +420,7 @@ export AGENTICDOME_PRODUCTION_MODE="false" # production hardening (st
394
420
  <details>
395
421
  <summary><strong>Full configuration reference — per-adapter variables</strong></summary>
396
422
 
397
- Every framework adapter exposes the same family of local hardening controls, prefixed per adapter: `AGENTICDOME_CREWAI_*`, `AGENTICDOME_PYDANTICAI_*`, `AGENTICDOME_LANGGRAPH_*`, `AGENTICDOME_MSAF_*` (Microsoft Agent Framework), `AGENTICDOME_FOUNDRY_*`, `AGENTICDOME_OPENAI_AGENTS_*`, `AGENTICDOME_AGNO_*`, `AGENTICDOME_BEDROCK_*`, `AGENTICDOME_GOOGLE_ADK_*`, and `AGENTICDOME_MCP_*`.
423
+ Every framework adapter exposes the same family of local hardening controls, prefixed per adapter: `AGENTICDOME_CREWAI_*`, `AGENTICDOME_PYDANTICAI_*`, `AGENTICDOME_LANGGRAPH_*`, `AGENTICDOME_MSAF_*` (Microsoft Agent Framework), `AGENTICDOME_AUTOGEN_*`, `AGENTICDOME_FOUNDRY_*`, `AGENTICDOME_OPENAI_AGENTS_*`, `AGENTICDOME_CLAUDE_*`, `AGENTICDOME_SMOLAGENTS_*`, `AGENTICDOME_AGNO_*`, `AGENTICDOME_BEDROCK_*`, `AGENTICDOME_GOOGLE_ADK_*`, and `AGENTICDOME_MCP_*`.
398
424
 
399
425
  **Common per-adapter pattern** (substitute the prefix for your adapter):
400
426
 
@@ -421,6 +447,11 @@ Every framework adapter exposes the same family of local hardening controls, pre
421
447
  | `AGENTICDOME_LANGGRAPH_AGENT_ID` | string | `langgraph_orchestrator` | Default LangGraph orchestrator node identity. |
422
448
  | `AGENTICDOME_LANGGRAPH_FINAL_ID` | string | `langgraph_final_node` | Default LangGraph final-output node identity. |
423
449
  | `AGENTICDOME_LANGGRAPH_REQUIRE_SERVER_TOKENS` | boolean | `false` | Requires handoff authorization responses to include server-issued decision tokens. |
450
+ | `AGENTICDOME_CLAUDE_AGENT_ID` | string | `claude_agent` | Default Claude Agent SDK identity. |
451
+ | `AGENTICDOME_CLAUDE_STRICT_DELEGATED_EXECUTION` | boolean | `true` | Requires server-issued decision tokens for Claude multi-agent handoffs. |
452
+ | `AGENTICDOME_SMOLAGENTS_AGENT_ID` | string | `smolagent` | Default smolagents identity. |
453
+ | `AGENTICDOME_SMOLAGENTS_SCAN_CODE_EXPRESSIONS` | boolean | `true` | Reviews CodeAgent-generated Python immediately before executor invocation. |
454
+ | `AGENTICDOME_SMOLAGENTS_STRICT_DELEGATED_EXECUTION` | boolean | `true` | Authorizes and verifies managed-agent handoffs using bound decision tokens. |
424
455
  | `AGENTICDOME_LANGGRAPH_STRICT_DELEGATED_EXECUTION` | boolean | `true` | Blocks delegated executions that carry delegation metadata without a valid token. |
425
456
  | `AGENTICDOME_FOUNDRY_REQUIRE_OUTPUT_SANITIZATION_IN_PROD` | boolean | `true` | Requires API-key-backed Mesh output sanitization when Foundry production mode is enabled. |
426
457
  | `AGENTICDOME_BEDROCK_AGENT_ID` | string | `aws_bedrock_agent` | Default agent identity for Bedrock runtime calls and local action handlers. |
@@ -467,8 +498,11 @@ One table, one decision. Find your runtime, apply the required code action, and
467
498
  | [PydanticAI](#pydanticai) | `agenticdome_sdk.pydantic` | Module where each `Agent(...)` and tool is constructed | `CyberSecFirewall(...)` + `create_hooks()`, `install_native_hooks(agent)`, or `attach_to_agent(agent)` | `@firewall.secure_tool(...)` with optional `tool_schema` validation |
468
499
  | [LangGraph](#langgraph) | `agenticdome_sdk.langgraph` | Module where `StateGraph` or LangChain `create_agent()` is assembled | Add `input_node()` / `transition_node()` / `graph_transition_node()` / `output_node()`, or `as_langchain_middleware()` | `wrap_agent_node()`, `wrap_tool_node()`, `security_route()` for blocked edges |
469
500
  | [Microsoft Agent Framework](#microsoft-agent-framework) | `agenticdome_sdk.microsoft_agent_framework` | Module where agents, workflows, tools, or middleware are declared | `create_middleware()`, `install_on_agent()`, or `run_agent_securely()` | `@firewall.secure_tool`, `wrap_tool_handler`, `secure_delegated_tool`, `wrap_delegated_tool_handler` |
501
+ | [Microsoft AutoGen](#microsoft-autogen) | `agenticdome_sdk.autogen` | AgentChat teams/Core runtimes; legacy 0.2 ConversableAgent loops | `wrap_team()`, `create_intervention_handler()`, `create_termination_condition()`, `attach_agentchat_agent()`, or `attach_conversable_agent()` | Core `FunctionCall` authorization plus inherited `wrap_tool_handler()` / `secure_tool()` |
470
502
  | [Microsoft AI Foundry](#microsoft-ai-foundry) | `agenticdome_sdk.microsoft_ai_foundry` | Module handling Foundry runs, function calls, or client construction | `create_middleware()`, `install_on_client()`, or `run_secure()` | `wrap_tool_executor()`, `@firewall.secure_tool(...)`, `before_tool_call()`, delegation verifiers |
471
503
  | [OpenAI Agents SDK](#openai-agents-sdk) | `agenticdome_sdk.openai_agents` | Module where `Agent`, `Runner.run(...)`, `@function_tool`, guardrails, or handoffs are declared | `run_agent_securely()`, `run_agent_stream_securely()`, `create_input_guardrail()`, `create_output_guardrail()` | `wrap_tool_handler()`, `wrap_delegated_tool_handler()`, `@firewall.secure_tool(...)`, handoff verifiers |
504
+ | [Claude Agent SDK](#claude-agent-sdk) | `agenticdome_sdk.claude` | Module constructing `ClaudeAgentOptions`, `ClaudeSDKClient`, SDK MCP tools, or `query()` | `install_on_options()` plus `run_client_securely()`, or `secure_query()` | Native `PreToolUse`/`PostToolUse` hooks, `wrap_tool_handler()`, and `secure_sdk_tool()` |
505
+ | [smolagents](#hugging-face-smolagents) | `agenticdome_sdk.smolagents` | Module constructing `CodeAgent`, `ToolCallingAgent`, tools, or managed agents | `run_agent_securely()` or `attach_firewall()` | Native `Tool` wrappers, CodeAgent executor proxy, observation callback, and managed-agent token verification |
472
506
  | [Agno](#agno) | `agenticdome_sdk.agno` | Module where `Agent`, Team, Workflow, or AgentOS components are declared | `attach_firewall(agent_or_team)`, `create_hook_bundle()`, `create_middleware()`, or `create_plugin()` | `@firewall.secure_tool(...)` for high-risk local tools |
473
507
  | [Google ADK](#google-adk) | `agenticdome_sdk.google_adk` | Module where `LlmAgent(...)` or ADK plugins are declared | `build_callback_kwargs()`, `create_plugin()`, or `install_on_agent(...)` | `wrap_tool_handler()` or `@firewall.secure_tool(...)` |
474
508
  | [LlamaIndex](#llamaindex) | `agenticdome_sdk.llamaindex` | Module where tools, query engines, retrievers, callbacks, or agents are assembled | `run_query_securely()`, `wrap_query_engine()`, `wrap_retriever()`, `create_node_postprocessor()`, `create_callback_handler()` | `wrap_tool_function()`, `to_function_tool()`, `@firewall.secure_tool(...)`, handoff verifiers |
@@ -994,6 +1028,108 @@ from agenticdome_sdk.microsoft_agent_framework import (
994
1028
 
995
1029
  ---
996
1030
 
1031
+ ### Microsoft AutoGen
1032
+
1033
+ AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy `ConversableAgent` deployments so teams can migrate without losing runtime enforcement.
1034
+
1035
+ ```bash
1036
+ # AutoGen AgentChat requires Python 3.10+.
1037
+ pip install "agenticdome-python-sdk[autogen]"
1038
+ ```
1039
+
1040
+ **Protect a current AgentChat team** — the wrapper screens the initial task, every streamed team event, and final messages while retaining the underlying Team API:
1041
+
1042
+ ```python
1043
+ from autogen_agentchat.teams import RoundRobinGroupChat
1044
+ from agenticdome_sdk.autogen import AgenticDomeAutoGenFirewall
1045
+
1046
+ firewall = AgenticDomeAutoGenFirewall()
1047
+ team = RoundRobinGroupChat([planner, researcher, payments_specialist], max_turns=12)
1048
+ secure_team = firewall.wrap_team(
1049
+ team,
1050
+ session_id="sess_prod_01J4X",
1051
+ agent_id="customer_operations_team",
1052
+ policy_context={"request_purpose": "customer_support"},
1053
+ )
1054
+
1055
+ result = await secure_team.run(task=user_prompt)
1056
+ ```
1057
+
1058
+ **Authorize AutoGen Core tool traffic at the runtime boundary** — current AutoGen sends `FunctionCall` messages to tool agents, so the intervention handler is a stronger boundary than patching an individual assistant:
1059
+
1060
+ ```python
1061
+ from autogen_core import SingleThreadedAgentRuntime
1062
+
1063
+ handler = firewall.create_intervention_handler(
1064
+ session_id="sess_prod_01J4X",
1065
+ agent_id="autogen_planner",
1066
+ )
1067
+ runtime = SingleThreadedAgentRuntime(intervention_handlers=[handler])
1068
+ ```
1069
+
1070
+ **Freeze a group chat on behavioral drift** — compose the AgenticDome condition with AutoGen's normal termination conditions:
1071
+
1072
+ ```python
1073
+ agenticdome_stop = firewall.create_termination_condition(
1074
+ session_id="sess_prod_01J4X",
1075
+ agent_id="customer_operations_team",
1076
+ )
1077
+ team = RoundRobinGroupChat(
1078
+ [planner, researcher, payments_specialist],
1079
+ termination_condition=agenticdome_stop | normal_stop,
1080
+ max_turns=12,
1081
+ )
1082
+ ```
1083
+
1084
+ Family 2 policy receives a bounded rolling conversation window digest, participant lineage, semantic-deviation evaluation request, and tool-call frequency. A blocked cross-agent message or excessive tool rate freezes the local session, reports a trust incident, and advances revocation state for the emitting agent before an external action can run.
1085
+
1086
+ **Existing AutoGen 0.2 deployments** — attach to the legacy `ConversableAgent.send()`, `receive()`, `a_send()`, and `a_receive()` lifecycles:
1087
+
1088
+ Keep the customer's already-certified legacy AutoGen dependency in place and install the dependency-light base SDK (do not use the `[autogen]` extra, because that extra deliberately installs the current AgentChat release):
1089
+
1090
+ ```bash
1091
+ pip install agenticdome-python-sdk
1092
+ ```
1093
+
1094
+ ```python
1095
+ assistant = firewall.attach_conversable_agent(
1096
+ assistant,
1097
+ session_id="sess_prod_01J4X",
1098
+ agent_id="legacy_autogen_assistant",
1099
+ )
1100
+ user_proxy = firewall.attach_conversable_agent(
1101
+ user_proxy,
1102
+ session_id="sess_prod_01J4X",
1103
+ agent_id="legacy_autogen_user_proxy",
1104
+ )
1105
+ ```
1106
+
1107
+ Wrap side-effecting local tools as well; conversation screening does not replace authorization at the execution boundary:
1108
+
1109
+ ```python
1110
+ secure_refund = firewall.wrap_tool_handler(
1111
+ tool_name="payments.refund.create",
1112
+ tool_platform="payments",
1113
+ handler=raw_refund,
1114
+ session_id="sess_prod_01J4X",
1115
+ agent_id="payments_specialist",
1116
+ )
1117
+ ```
1118
+
1119
+ ```bash
1120
+ export AGENTICDOME_PLATFORM="autogen"
1121
+ export AGENTICDOME_PRODUCTION_MODE="true"
1122
+ export AGENTICDOME_REQUIRE_STABLE_SESSION_ID_IN_PROD="true"
1123
+ export AGENTICDOME_AUTOGEN_CONVERSATION_WINDOW="12"
1124
+ export AGENTICDOME_AUTOGEN_MAX_TOOL_CALLS_PER_WINDOW="8"
1125
+ export AGENTICDOME_AUTOGEN_FREEZE_ON_BLOCK="true"
1126
+ export AGENTICDOME_AUTOGEN_REVOKE_ON_FREEZE="true"
1127
+ ```
1128
+
1129
+ Official references: [AutoGen project status and migration guidance](https://github.com/microsoft/autogen) · [AgentChat teams](https://microsoft.github.io/autogen/stable/reference/python/autogen_agentchat.teams.html) · [Core intervention handlers](https://microsoft.github.io/autogen/dev/user-guide/core-user-guide/cookbook/tool-use-with-intervention.html) · [Legacy 0.2 conversational agents](https://microsoft.github.io/autogen/0.2/docs/Use-Cases/agent_chat/)
1130
+
1131
+ ---
1132
+
997
1133
  ### Microsoft AI Foundry
998
1134
 
999
1135
  For services that call Foundry agents, handle function-call requests from Foundry, execute local function tools, or use `FoundryChatClient` with local tools.
@@ -1269,6 +1405,138 @@ from agenticdome_sdk.openai_agents import (
1269
1405
 
1270
1406
  ---
1271
1407
 
1408
+ ### Claude Agent SDK
1409
+
1410
+ The adapter uses Claude Agent SDK's native hook contract for prompt submission, pre-tool permission decisions, and post-tool output replacement. It also wraps the asynchronous `query()` and `ClaudeSDKClient.receive_response()` pipelines so final assistant text is reviewed before your application returns it.
1411
+
1412
+ ```bash
1413
+ pip install "agenticdome-python-sdk[claude]"
1414
+ ```
1415
+
1416
+ **Secure a `ClaudeSDKClient` and its built-in/MCP tools:**
1417
+
1418
+ ```python
1419
+ from claude_agent_sdk import ClaudeAgentOptions, ClaudeSDKClient
1420
+ from agenticdome_sdk.claude import AgenticDomeClaudeFirewall
1421
+
1422
+ firewall = AgenticDomeClaudeFirewall()
1423
+ options = ClaudeAgentOptions(allowed_tools=["Read", "mcp__crm__lookup"])
1424
+ firewall.install_on_options(
1425
+ options,
1426
+ session_id="sess_prod_01J4X",
1427
+ agent_id="claude_support_agent",
1428
+ )
1429
+
1430
+ async with ClaudeSDKClient(options=options) as client:
1431
+ async for message in firewall.run_client_securely(
1432
+ client,
1433
+ "Look up the customer's active support case.",
1434
+ session_id="sess_prod_01J4X",
1435
+ agent_id="claude_support_agent",
1436
+ ):
1437
+ consume(message)
1438
+ ```
1439
+
1440
+ For the one-shot API, iterate `firewall.secure_query(prompt, session_id=..., options=...)`. If the run may execute built-in tools, install the returned hook matchers on its options as well; `secure_query()` itself covers ingress and returned messages.
1441
+
1442
+ **Compose with Claude's native SDK MCP `@tool`:**
1443
+
1444
+ ```python
1445
+ @firewall.secure_sdk_tool(
1446
+ "lookup_customer",
1447
+ "Look up a customer support profile",
1448
+ {"customer_id": str},
1449
+ session_id="sess_prod_01J4X",
1450
+ agent_id="claude_support_agent",
1451
+ tool_platform="crm",
1452
+ )
1453
+ async def lookup_customer(args):
1454
+ return {"content": [{"type": "text", "text": crm_lookup(args["customer_id"])}]}
1455
+ ```
1456
+
1457
+ The `PreToolUse` hook returns Claude's native `permissionDecision: deny` response before local side effects. If policy supplies sanitized arguments, it returns `updatedInput`. The `PostToolUse` hook uses `updatedToolOutput` so DLP-reviewed tool data is what the model sees.
1458
+
1459
+ ```bash
1460
+ export AGENTICDOME_PLATFORM="claude_agent_sdk"
1461
+ export AGENTICDOME_CLAUDE_AGENT_ID="claude_support_agent"
1462
+ export AGENTICDOME_CLAUDE_MAX_INPUT_CHARS="50000"
1463
+ export AGENTICDOME_CLAUDE_MAX_OUTPUT_CHARS="100000"
1464
+ export AGENTICDOME_CLAUDE_MAX_TOOL_ARG_CHARS="20000"
1465
+ export AGENTICDOME_CLAUDE_STREAMING_BUFFER_CHARS="4000"
1466
+ export AGENTICDOME_CLAUDE_RATE_LIMIT_PER_MINUTE="60"
1467
+ export AGENTICDOME_CLAUDE_RETRY_ATTEMPTS="2"
1468
+ export AGENTICDOME_CLAUDE_RETRY_BACKOFF_S="0.25"
1469
+ export AGENTICDOME_CLAUDE_CIRCUIT_BREAKER_FAILURES="5"
1470
+ export AGENTICDOME_CLAUDE_CIRCUIT_BREAKER_RESET_S="60"
1471
+ export AGENTICDOME_CLAUDE_AUDIT_LOGGING="true"
1472
+ export AGENTICDOME_CLAUDE_OTEL_ENABLED="true"
1473
+ export AGENTICDOME_CLAUDE_STRICT_DELEGATED_EXECUTION="true"
1474
+ export AGENTICDOME_CLAUDE_EMERGENCY_BLOCK_TOOLS=""
1475
+ export AGENTICDOME_CLAUDE_EMERGENCY_BLOCK_AGENTS=""
1476
+ ```
1477
+
1478
+ Use `authorize_manager_handoff()` and `verify_specialist_execution()` when a manager delegates sensitive work. Configure Redis and `AGENTICDOME_TOKEN_HMAC_SECRET` when authorization and specialist execution can land on different workers. Claude hooks protect operations visible to the local SDK process; externally hosted services still require enforcement at their local gateway or MCP host.
1479
+
1480
+ Official references: [Claude Agent SDK Python](https://github.com/anthropics/claude-agent-sdk-python) · [Claude Agent SDK overview](https://platform.claude.com/docs/en/agent-sdk/overview)
1481
+
1482
+ ---
1483
+
1484
+ ### Hugging Face smolagents
1485
+
1486
+ smolagents `CodeAgent` generates Python and invokes `python_executor(code)` before step callbacks run. The adapter therefore wraps the executor itself, wraps every native `Tool`, sanitizes step observations before the next model turn, and enforces managed-agent handoffs with bound decision tokens.
1487
+
1488
+ ```bash
1489
+ pip install "agenticdome-python-sdk[smolagents]"
1490
+ ```
1491
+
1492
+ ```python
1493
+ from smolagents import CodeAgent, InferenceClientModel, tool
1494
+ from agenticdome_sdk.smolagents import AgenticDomeSmolagentsFirewall
1495
+
1496
+ @tool
1497
+ def lookup_customer(customer_id: str) -> str:
1498
+ """Look up a customer by ID."""
1499
+ return crm_lookup(customer_id)
1500
+
1501
+ agent = CodeAgent(tools=[lookup_customer], model=InferenceClientModel())
1502
+ firewall = AgenticDomeSmolagentsFirewall()
1503
+
1504
+ result = firewall.run_agent_securely(
1505
+ agent,
1506
+ "Look up customer cust_123 for their active support case.",
1507
+ session_id="sess_prod_01J4X",
1508
+ agent_id="smol_support_agent",
1509
+ )
1510
+ ```
1511
+
1512
+ `attach_firewall(agent, session_id=...)` is idempotent and can be used when another component owns `agent.run()`. For streaming, use `run_agent_stream_securely()` so event output is reviewed before it is yielded. Direct `agent.run()` after attachment still gets tool, code, managed-agent, and step-observation enforcement, but the application should use the secure run wrapper for final-output DLP.
1513
+
1514
+ ```bash
1515
+ export AGENTICDOME_PLATFORM="smolagents"
1516
+ export AGENTICDOME_SMOLAGENTS_AGENT_ID="smol_support_agent"
1517
+ export AGENTICDOME_SMOLAGENTS_MAX_INPUT_CHARS="50000"
1518
+ export AGENTICDOME_SMOLAGENTS_MAX_OUTPUT_CHARS="100000"
1519
+ export AGENTICDOME_SMOLAGENTS_MAX_TOOL_ARG_CHARS="20000"
1520
+ export AGENTICDOME_SMOLAGENTS_STREAMING_BUFFER_CHARS="4000"
1521
+ export AGENTICDOME_SMOLAGENTS_RATE_LIMIT_PER_MINUTE="60"
1522
+ export AGENTICDOME_SMOLAGENTS_RETRY_ATTEMPTS="2"
1523
+ export AGENTICDOME_SMOLAGENTS_RETRY_BACKOFF_S="0.25"
1524
+ export AGENTICDOME_SMOLAGENTS_CIRCUIT_BREAKER_FAILURES="5"
1525
+ export AGENTICDOME_SMOLAGENTS_CIRCUIT_BREAKER_RESET_S="60"
1526
+ export AGENTICDOME_SMOLAGENTS_AUDIT_LOGGING="true"
1527
+ export AGENTICDOME_SMOLAGENTS_OTEL_ENABLED="true"
1528
+ export AGENTICDOME_SMOLAGENTS_EMERGENCY_BLOCK_TOOLS=""
1529
+ export AGENTICDOME_SMOLAGENTS_EMERGENCY_BLOCK_AGENTS=""
1530
+ export AGENTICDOME_SMOLAGENTS_STRICT_DELEGATED_EXECUTION="true"
1531
+ export AGENTICDOME_SMOLAGENTS_SCAN_CODE_EXPRESSIONS="true"
1532
+ ```
1533
+
1534
+ Keep code-expression scanning enabled in production. It adds business-intent policy before smolagents' local or remote executor; it does not replace the executor's OS/container/WASM sandbox. The adapter intentionally sends generated code and serialized tool arguments to the configured AgenticDome sidecar, so place that sidecar within the approved trust boundary and apply normal data-residency controls.
1535
+
1536
+ Official references: [smolagents agents](https://huggingface.co/docs/smolagents/main/reference/agents) · [smolagents tools](https://huggingface.co/docs/smolagents/main/reference/tools)
1537
+
1538
+ ---
1539
+
1272
1540
  ### Agno
1273
1541
 
1274
1542
  Agno's Agent reference documents `pre_hooks`, `post_hooks`, and `tool_hooks`; the adapter attaches to those boundaries so policy is enforced before prompts/tools run and before output returns. Middleware/plugin-shaped helpers are available for applications that centralize hook registration.
@@ -2215,7 +2483,7 @@ source .venv/bin/activate
2215
2483
 
2216
2484
  python -m pip install --upgrade pip setuptools wheel
2217
2485
  python -m pip install -e ".[dev]"
2218
- python -m pip install -e ".[crewai,pydanticai,langgraph,microsoft,foundry,agno,openai-agents,mcp,bedrock,google-adk,llamaindex,redis]"
2486
+ python -m pip install -e ".[crewai,pydanticai,langgraph,microsoft,autogen,foundry,agno,openai-agents,claude,smolagents,mcp,bedrock,google-adk,llamaindex,redis]"
2219
2487
 
2220
2488
  python -m pytest -q
2221
2489
  rm -rf build dist *.egg-info agenticdome_sdk.egg-info agenticdome_python_sdk.egg-info
@@ -2238,12 +2506,16 @@ python -m pytest -q tests/test_langgraph_integration.py
2238
2506
  | :--- | :--- | :--- |
2239
2507
  | Core SDK client | `python -m pytest -q tests/test_client.py` | Request validation, headers, guardrail calls, A2A/MCP JSON-RPC calls, Mesh DLP, HTTP errors, JSON handling |
2240
2508
  | Package contract | `python -m pytest -q tests/test_packaging_contract.py` | `pyproject.toml` metadata, legacy `setup.py` shim, public exports, manifest hygiene, ignored build artifacts, documented extras |
2509
+ | Attack demos | `python -m pytest -q tests/test_attack_demo.py` | Offline vulnerable-vs-protected CLI coverage, including AutoGen, Claude Agent SDK, and Hugging Face smolagents |
2241
2510
  | CrewAI | `python -m pytest -q tests/test_crewai_integration.py` | Prompt/tool hooks, handoff token injection, specialist verification, output redaction, schema checks, rate limits, retries, streaming DLP |
2242
2511
  | PydanticAI | `python -m pytest -q tests/test_pydanticai_integration.py` | Agent hooks, secure tools, sanitized arguments, token-store fallback, production session enforcement, rate limits, retries, streaming output |
2243
2512
  | LangGraph / LangChain | `python -m pytest -q tests/test_langgraph_integration.py` | Graph input, transition, tool, retrieval, middleware, security routing, token consumption, output DLP, streaming events |
2244
2513
  | Microsoft Agent Framework | `python -m pytest -q tests/test_microsoft_agent_framework_integration.py` | Tool/run boundaries, delegated tool verification, middleware install helpers, identity context, Copilot enforcement hooks, streaming output |
2514
+ | Microsoft AutoGen | `python -m pytest -q tests/test_autogen_integration.py` | Current AgentChat team/Core interception, legacy send/receive hooks, rolling Family 2 context, session freeze, trust incident and revocation escalation |
2245
2515
  | Microsoft AI Foundry | `python -m pytest -q tests/test_microsoft_ai_foundry_integration.py` | Prompt threat contracts, local tool executors, run boundaries, bearer/API-key configuration, delegated execution, circuit breaker, stream DLP |
2246
2516
  | OpenAI Agents SDK | `python -m pytest -q tests/test_openai_agents_integration.py` | Runner wrappers, guardrail helpers, function-tool wrappers, handoff/delegated tools, HMAC token storage, schema checks, retries, streaming output |
2517
+ | Claude Agent SDK | `python -m pytest -q tests/test_claude_integration.py` | Native prompt/tool hooks, tool-output replacement, secure query responses, decision-token binding and one-time consumption |
2518
+ | Hugging Face smolagents | `python -m pytest -q tests/test_smolagents_integration.py` | Native Tool wrapper, pre-execution CodeAgent scanning, idempotent attachment, managed-agent handoff verification, output DLP |
2247
2519
  | Agno | `python -m pytest -q tests/test_agno_integration.py` | Agent/team hooks, tool hooks, middleware/plugin helpers, delegated specialist execution, retrieved text sanitization, schema checks, stream DLP |
2248
2520
  | MCP host / gateway | `python -m pytest -q tests/test_mcp_host_integration.py` | JSON-RPC preflight, tool/resource/prompt authorization, private metadata stripping, delegated token verification, response filtering, forwarder DLP |
2249
2521
  | AWS Bedrock | `python -m pytest -q tests/test_aws_bedrock_integration.py` | Converse/InvokeModel wrappers, Bedrock Agents streams, action-group Lambda wrappers, retrieval DLP, tool authorization, handoff tokens, retries |
@@ -2264,7 +2536,7 @@ python -m twine check dist/*
2264
2536
  **Full offline release gate** across all supported Python integrations:
2265
2537
 
2266
2538
  ```bash
2267
- python -m pip install -e ".[dev,crewai,pydanticai,langgraph,microsoft,foundry,agno,openai-agents,mcp,bedrock,google-adk,llamaindex,redis]"
2539
+ python -m pip install -e ".[dev,crewai,pydanticai,langgraph,microsoft,autogen,foundry,agno,openai-agents,claude,smolagents,mcp,bedrock,google-adk,llamaindex,redis]"
2268
2540
  python -m pytest -q
2269
2541
  rm -rf build dist *.egg-info agenticdome_sdk.egg-info agenticdome_python_sdk.egg-info
2270
2542
  python -m build
{agenticdome_python_sdk-1.2.1.dist-info → agenticdome_python_sdk-1.2.3.dist-info}/RECORD RENAMED
@@ -1,7 +1,10 @@
1
- agenticdome_python_sdk-1.2.1.dist-info/licenses/LICENSE,sha256=lqAH8G9tU2WPK9fzrnM_QMd4XUrh9fsmPqKE_hniKpM,718
1
+ agenticdome_python_sdk-1.2.3.dist-info/licenses/LICENSE,sha256=lqAH8G9tU2WPK9fzrnM_QMd4XUrh9fsmPqKE_hniKpM,718
2
2
  agenticdome_sdk/__init__.py,sha256=6eOHJkY_Ir51dRKTktObXS40PjUsHrWMEQ2V3N0ItN4,576
3
+ agenticdome_sdk/_framework_firewall.py,sha256=XJaKgDlVFfZJXVg1vL8jQOZDH05g8P9GQseh8J22p4M,27860
3
4
  agenticdome_sdk/agno.py,sha256=3gbc5URNTAHyNVAaAH882CpQpMecTv0R6S0CNMDOgos,60686
5
+ agenticdome_sdk/autogen.py,sha256=0NAqCxk9zTyRZX7LnqqdT9cSzjbAJjQVgz6aq9QWy0Q,29015
4
6
  agenticdome_sdk/aws_bedrock.py,sha256=Z1Rcbps7VgvETmq_wrUbIvg6lJxsoe7YJEPZYkBKr80,69498
7
+ agenticdome_sdk/claude.py,sha256=LEmfIAXOkZlbE_XISDHagze2JiDlRUA_j776ntP4QwM,17454
5
8
  agenticdome_sdk/client.py,sha256=rRFqW5zXVDYGqDrchy3D-HxRaDINttcgYu8VRQXnceU,48658
6
9
  agenticdome_sdk/crewai.py,sha256=7o7yapjbGfxfHGrmKtnpERIeJlDKIRgqz2h1WpLQJkQ,52389
7
10
  agenticdome_sdk/google_adk.py,sha256=U23uSvUxgeQRUX6fGewls0CU0GI8mru67O1mHti7RkA,57175
@@ -15,7 +18,8 @@ agenticdome_sdk/openai_agents.py,sha256=bWoJ2hjCyXDWl5Eo4pjeRr_MOQgNOZW7QE9WRDo6
15
18
  agenticdome_sdk/proof.py,sha256=ECKc14xSE0V1HHmcpZjfVz8-Q2H_fooah3BfdblFV8M,2878
16
19
  agenticdome_sdk/pydantic.py,sha256=7R6X0JgPIMLcWO682wcpN0X8dSMVEiwvVc4ydUN111s,54882
17
20
  agenticdome_sdk/scenarios.py,sha256=QROC_JWKwub5AdpP9pLXdJCpotEACkF-qgKAnDAo8XA,7882
18
- agenticdome_python_sdk-1.2.1.dist-info/METADATA,sha256=mVWu8XEEzyXiZYYIurNM6q3-6mMrVX4dJrhff69Qw8s,112979
19
- agenticdome_python_sdk-1.2.1.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
20
- agenticdome_python_sdk-1.2.1.dist-info/top_level.txt,sha256=LZbbjXco5mqDrGwlTJpIKI5Sp6R_njzHHjExxAs9c3s,16
21
- agenticdome_python_sdk-1.2.1.dist-info/RECORD,,
21
+ agenticdome_sdk/smolagents.py,sha256=j51nHazdFvA2DNRv6mibKKcEkZvw__xg6bjPUrhMKuk,19092
22
+ agenticdome_python_sdk-1.2.3.dist-info/METADATA,sha256=RthBXIsCPHzc1iYbENsoCbtmZfZO7xg71Gw-BDqEJRg,128670
23
+ agenticdome_python_sdk-1.2.3.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
24
+ agenticdome_python_sdk-1.2.3.dist-info/top_level.txt,sha256=LZbbjXco5mqDrGwlTJpIKI5Sp6R_njzHHjExxAs9c3s,16
25
+ agenticdome_python_sdk-1.2.3.dist-info/RECORD,,