agentkey 1.0.0__tar.gz

agentkey-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AgentKey
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

agentkey-1.0.0/PKG-INFO

@@ -0,0 +1,193 @@
+Metadata-Version: 2.4
+Name: agentkey
+Version: 1.0.0
+Summary: Authorization and evidence SDK for AI agents: check permissions before every action, record what agents actually did.
+Author: AgentKey
+License: MIT
+Project-URL: Homepage, https://agentkey.base44.app
+Project-URL: Documentation, https://agentkey.base44.app/docs
+Keywords: ai,agents,authorization,permissions,audit,mcp,security,llm
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# AgentKey SDK
+
+AgentKey is an authorization and evidence layer for AI agents. Before an agent takes an action, the SDK asks the AgentKey API whether it is allowed, denied, or requires human approval. Both the decision and what the agent actually did are recorded as hash-chained evidence events you can inspect in a dashboard.
+
+## Installation
+
+Python (3.8+, zero dependencies):
+
+```bash
+pip install agentkey
+```
+
+JavaScript / TypeScript (Node 18+, zero dependencies, ESM):
+
+```bash
+npm install agentkey
+```
+
+## Get an API key
+
+1. Sign up at the AgentKey dashboard: https://agentkey.base44.app
+2. Open the Connect wizard (or Agents, then create an agent).
+3. Generate an API key. It is shown once; store it as an environment variable and do not hard-code it.
+
+## First authorization (Python)
+
+```python
+from agentkey import AgentKeyClient
+
+ak = AgentKeyClient(api_key="agent_live_xxxxx")  # production API by default
+
+result = ak.check_permission(action="send_email", resource="gmail", arguments={"to": "x@company.com"})
+if result["allowed"]:
+    send_email(...)  # your code
+else:
+    print("Blocked:", result["reason"], "approval_required:", result.get("approval_required", False))
+```
+
+## First authorization (JavaScript / TypeScript)
+
+```js
+import { AgentKeyClient } from "agentkey";
+
+const ak = new AgentKeyClient({ apiKey: "agent_live_xxxxx" }); // production API by default
+
+const result = await ak.checkPermission({
+  action: "send_email",
+  resource: "gmail",
+  arguments: { to: "x@company.com" },
+});
+if (result.allowed) {
+  await sendEmail(); // your code
+} else {
+  console.log("Blocked:", result.reason, "approval_required:", result.approval_required ?? false);
+}
+```
+
+## Decisions: allow, deny, ask
+
+`check_permission` / `checkPermission` evaluates the permissions you configured for the agent:
+
+- **allow**: `allowed: true`. Run the action, then record the execution (below).
+- **deny**: `allowed: false` with the server's reason. Do not run the action.
+- **ask** (human approval): `allowed: false`, `approval_required: true`. The request appears on the Approvals page in the dashboard, where a human approves or denies it. Do not run the action until it is approved.
+
+Fail-closed: if the service cannot return a valid decision within 5 seconds, the SDK returns:
+
+```json
+{ "allowed": false, "reason": "agentkey_unreachable", "fail_closed": true }
+```
+
+Treat `fail_closed: true` as an infrastructure failure and `allowed: false` without it as an authorization decision. Either way the agent must not proceed.
+
+## wrap(): authorize every tool call in one line
+
+```python
+agent = ak.wrap(my_agent)                   # observe (default): records, blocks nothing
+agent = ak.wrap(my_agent, mode="enforce")   # raises AgentKeyDenied on a denial
+```
+
+```js
+const agent = ak.wrap(myAgent);                    // observe (default)
+const agent = ak.wrap(myAgent, { mode: "enforce" }); // raises AgentKeyDenied on a denial
+```
+
+`wrap()` detects an MCP client (`callTool` / `call_tool`), a LangChain agent or tool list, a plain object or dict of functions, or a single function. Observe mode records every call and blocks nothing, so you can see what AgentKey would have caught before trusting it with enforcement. Enforce mode raises `AgentKeyDenied` and does not run the tool. If no session id is passed, a session is started automatically and ended best-effort at process exit.
+
+## Sessions
+
+Every decision and execution is recorded as an evidence event on the session's hash chain. Group a task into one session:
+
+```python
+s = ak.start_session()
+# ... checks and actions ...
+ak.end_session(s["session_id"])
+```
+
+```js
+const s = await ak.startSession();
+// ... checks and actions ...
+await ak.endSession({ sessionId: s.session_id });
+```
+
+## Recording what the agent actually did
+
+After an allowed action runs, record the execution, linked back to its decision by `authorization_id`:
+
+```python
+auth = ak.check_permission(action="send_email", resource="gmail", session_id=sid)
+if auth["allowed"]:
+    send_email(...)
+    ak.record_action(session_id=sid, authorization_id=auth["event_id"], tool="gmail",
+                     action="send_email", resource="gmail", result_status="success")
+```
+
+`record_action` never refuses to record, so evidence is not lost for billing reasons. Actions that run without any authorization decision are surfaced on the dashboard as findings (`executions_without_authorization`), because the SDK is self-reported: an agent that bypasses the wrapped functions produces no evidence.
+
+## guard(): authorize, run, record in one call
+
+```python
+out = ak.guard(sid, "gmail", "send_email", lambda: send_email(...), arguments={"to": "x@company.com"})
+```
+
+```js
+const out = await ak.guard({ sessionId: sid, resource: "gmail", action: "send_email" }, async () => sendEmail());
+```
+
+If authorize denies, `guard` returns the denial and does not run the function.
+
+## Delegated authorization
+
+A parent agent can delegate a scoped subset of its permissions to a child agent. Scopes are `resource:action` strings, must be a subset of the parent's own permissions, and chains are depth-limited. See `delegate()` in the source docstrings.
+
+## Production API
+
+Base URL: `https://agentkey.base44.app` (the SDK default). Override it with `base_url` (Python) or `baseUrl` (JavaScript) if you self-host.
+
+All endpoints are POST with a Bearer API key, under `/api/functions/`:
+
+- `authorize`
+- `record_action`
+- `start_session`
+- `end_session`
+- `delegate`
+- `validate_api_key` (GET)
+
+Raw HTTP:
+
+```bash
+curl -X POST https://agentkey.base44.app/api/functions/authorize \
+  -H "Authorization: Bearer agent_live_xxxxx" \
+  -H "Content-Type: application/json" \
+  -d '{"action":"send_email","resource":"gmail","arguments":{"to":"x@company.com"}}'
+```
+
+## Dashboard
+
+Sessions, evidence events, approvals, findings and permission settings: https://agentkey.base44.app
+
+## Security limitations (current, accurate)
+
+- Evidence events are hash-chained per session, and session Merkle roots are attested with HMAC-SHA256 under a server-side key. This detects altered or missing events in stored evidence. It is not an asymmetric digital signature scheme, it does not make records forgery-proof against a compromised server, and it is not a non-repudiation guarantee.
+- SDK instrumentation is self-reported. `wrap()` and `record_action` record what the agent reports; an agent that calls tools outside the SDK produces no evidence. This is reported as an `executions_without_authorization` finding, but not prevented.
+- Checks fail closed on network errors and timeouts. In observe mode the SDK still lets the call run; only enforce mode blocks it.
+- No SOC 2 or other third-party compliance audit has been completed.
+
+License: MIT.

agentkey-1.0.0/README.md

@@ -0,0 +1,167 @@
+# AgentKey SDK
+
+AgentKey is an authorization and evidence layer for AI agents. Before an agent takes an action, the SDK asks the AgentKey API whether it is allowed, denied, or requires human approval. Both the decision and what the agent actually did are recorded as hash-chained evidence events you can inspect in a dashboard.
+
+## Installation
+
+Python (3.8+, zero dependencies):
+
+```bash
+pip install agentkey
+```
+
+JavaScript / TypeScript (Node 18+, zero dependencies, ESM):
+
+```bash
+npm install agentkey
+```
+
+## Get an API key
+
+1. Sign up at the AgentKey dashboard: https://agentkey.base44.app
+2. Open the Connect wizard (or Agents, then create an agent).
+3. Generate an API key. It is shown once; store it as an environment variable and do not hard-code it.
+
+## First authorization (Python)
+
+```python
+from agentkey import AgentKeyClient
+
+ak = AgentKeyClient(api_key="agent_live_xxxxx")  # production API by default
+
+result = ak.check_permission(action="send_email", resource="gmail", arguments={"to": "x@company.com"})
+if result["allowed"]:
+    send_email(...)  # your code
+else:
+    print("Blocked:", result["reason"], "approval_required:", result.get("approval_required", False))
+```
+
+## First authorization (JavaScript / TypeScript)
+
+```js
+import { AgentKeyClient } from "agentkey";
+
+const ak = new AgentKeyClient({ apiKey: "agent_live_xxxxx" }); // production API by default
+
+const result = await ak.checkPermission({
+  action: "send_email",
+  resource: "gmail",
+  arguments: { to: "x@company.com" },
+});
+if (result.allowed) {
+  await sendEmail(); // your code
+} else {
+  console.log("Blocked:", result.reason, "approval_required:", result.approval_required ?? false);
+}
+```
+
+## Decisions: allow, deny, ask
+
+`check_permission` / `checkPermission` evaluates the permissions you configured for the agent:
+
+- **allow**: `allowed: true`. Run the action, then record the execution (below).
+- **deny**: `allowed: false` with the server's reason. Do not run the action.
+- **ask** (human approval): `allowed: false`, `approval_required: true`. The request appears on the Approvals page in the dashboard, where a human approves or denies it. Do not run the action until it is approved.
+
+Fail-closed: if the service cannot return a valid decision within 5 seconds, the SDK returns:
+
+```json
+{ "allowed": false, "reason": "agentkey_unreachable", "fail_closed": true }
+```
+
+Treat `fail_closed: true` as an infrastructure failure and `allowed: false` without it as an authorization decision. Either way the agent must not proceed.
+
+## wrap(): authorize every tool call in one line
+
+```python
+agent = ak.wrap(my_agent)                   # observe (default): records, blocks nothing
+agent = ak.wrap(my_agent, mode="enforce")   # raises AgentKeyDenied on a denial
+```
+
+```js
+const agent = ak.wrap(myAgent);                    // observe (default)
+const agent = ak.wrap(myAgent, { mode: "enforce" }); // raises AgentKeyDenied on a denial
+```
+
+`wrap()` detects an MCP client (`callTool` / `call_tool`), a LangChain agent or tool list, a plain object or dict of functions, or a single function. Observe mode records every call and blocks nothing, so you can see what AgentKey would have caught before trusting it with enforcement. Enforce mode raises `AgentKeyDenied` and does not run the tool. If no session id is passed, a session is started automatically and ended best-effort at process exit.
+
+## Sessions
+
+Every decision and execution is recorded as an evidence event on the session's hash chain. Group a task into one session:
+
+```python
+s = ak.start_session()
+# ... checks and actions ...
+ak.end_session(s["session_id"])
+```
+
+```js
+const s = await ak.startSession();
+// ... checks and actions ...
+await ak.endSession({ sessionId: s.session_id });
+```
+
+## Recording what the agent actually did
+
+After an allowed action runs, record the execution, linked back to its decision by `authorization_id`:
+
+```python
+auth = ak.check_permission(action="send_email", resource="gmail", session_id=sid)
+if auth["allowed"]:
+    send_email(...)
+    ak.record_action(session_id=sid, authorization_id=auth["event_id"], tool="gmail",
+                     action="send_email", resource="gmail", result_status="success")
+```
+
+`record_action` never refuses to record, so evidence is not lost for billing reasons. Actions that run without any authorization decision are surfaced on the dashboard as findings (`executions_without_authorization`), because the SDK is self-reported: an agent that bypasses the wrapped functions produces no evidence.
+
+## guard(): authorize, run, record in one call
+
+```python
+out = ak.guard(sid, "gmail", "send_email", lambda: send_email(...), arguments={"to": "x@company.com"})
+```
+
+```js
+const out = await ak.guard({ sessionId: sid, resource: "gmail", action: "send_email" }, async () => sendEmail());
+```
+
+If authorize denies, `guard` returns the denial and does not run the function.
+
+## Delegated authorization
+
+A parent agent can delegate a scoped subset of its permissions to a child agent. Scopes are `resource:action` strings, must be a subset of the parent's own permissions, and chains are depth-limited. See `delegate()` in the source docstrings.
+
+## Production API
+
+Base URL: `https://agentkey.base44.app` (the SDK default). Override it with `base_url` (Python) or `baseUrl` (JavaScript) if you self-host.
+
+All endpoints are POST with a Bearer API key, under `/api/functions/`:
+
+- `authorize`
+- `record_action`
+- `start_session`
+- `end_session`
+- `delegate`
+- `validate_api_key` (GET)
+
+Raw HTTP:
+
+```bash
+curl -X POST https://agentkey.base44.app/api/functions/authorize \
+  -H "Authorization: Bearer agent_live_xxxxx" \
+  -H "Content-Type: application/json" \
+  -d '{"action":"send_email","resource":"gmail","arguments":{"to":"x@company.com"}}'
+```
+
+## Dashboard
+
+Sessions, evidence events, approvals, findings and permission settings: https://agentkey.base44.app
+
+## Security limitations (current, accurate)
+
+- Evidence events are hash-chained per session, and session Merkle roots are attested with HMAC-SHA256 under a server-side key. This detects altered or missing events in stored evidence. It is not an asymmetric digital signature scheme, it does not make records forgery-proof against a compromised server, and it is not a non-repudiation guarantee.
+- SDK instrumentation is self-reported. `wrap()` and `record_action` record what the agent reports; an agent that calls tools outside the SDK produces no evidence. This is reported as an `executions_without_authorization` finding, but not prevented.
+- Checks fail closed on network errors and timeouts. In observe mode the SDK still lets the call run; only enforce mode blocks it.
+- No SOC 2 or other third-party compliance audit has been completed.
+
+License: MIT.

agentkey-1.0.0/agentkey.egg-info/PKG-INFO

@@ -0,0 +1,193 @@
+Metadata-Version: 2.4
+Name: agentkey
+Version: 1.0.0
+Summary: Authorization and evidence SDK for AI agents: check permissions before every action, record what agents actually did.
+Author: AgentKey
+License: MIT
+Project-URL: Homepage, https://agentkey.base44.app
+Project-URL: Documentation, https://agentkey.base44.app/docs
+Keywords: ai,agents,authorization,permissions,audit,mcp,security,llm
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# AgentKey SDK
+
+AgentKey is an authorization and evidence layer for AI agents. Before an agent takes an action, the SDK asks the AgentKey API whether it is allowed, denied, or requires human approval. Both the decision and what the agent actually did are recorded as hash-chained evidence events you can inspect in a dashboard.
+
+## Installation
+
+Python (3.8+, zero dependencies):
+
+```bash
+pip install agentkey
+```
+
+JavaScript / TypeScript (Node 18+, zero dependencies, ESM):
+
+```bash
+npm install agentkey
+```
+
+## Get an API key
+
+1. Sign up at the AgentKey dashboard: https://agentkey.base44.app
+2. Open the Connect wizard (or Agents, then create an agent).
+3. Generate an API key. It is shown once; store it as an environment variable and do not hard-code it.
+
+## First authorization (Python)
+
+```python
+from agentkey import AgentKeyClient
+
+ak = AgentKeyClient(api_key="agent_live_xxxxx")  # production API by default
+
+result = ak.check_permission(action="send_email", resource="gmail", arguments={"to": "x@company.com"})
+if result["allowed"]:
+    send_email(...)  # your code
+else:
+    print("Blocked:", result["reason"], "approval_required:", result.get("approval_required", False))
+```
+
+## First authorization (JavaScript / TypeScript)
+
+```js
+import { AgentKeyClient } from "agentkey";
+
+const ak = new AgentKeyClient({ apiKey: "agent_live_xxxxx" }); // production API by default
+
+const result = await ak.checkPermission({
+  action: "send_email",
+  resource: "gmail",
+  arguments: { to: "x@company.com" },
+});
+if (result.allowed) {
+  await sendEmail(); // your code
+} else {
+  console.log("Blocked:", result.reason, "approval_required:", result.approval_required ?? false);
+}
+```
+
+## Decisions: allow, deny, ask
+
+`check_permission` / `checkPermission` evaluates the permissions you configured for the agent:
+
+- **allow**: `allowed: true`. Run the action, then record the execution (below).
+- **deny**: `allowed: false` with the server's reason. Do not run the action.
+- **ask** (human approval): `allowed: false`, `approval_required: true`. The request appears on the Approvals page in the dashboard, where a human approves or denies it. Do not run the action until it is approved.
+
+Fail-closed: if the service cannot return a valid decision within 5 seconds, the SDK returns:
+
+```json
+{ "allowed": false, "reason": "agentkey_unreachable", "fail_closed": true }
+```
+
+Treat `fail_closed: true` as an infrastructure failure and `allowed: false` without it as an authorization decision. Either way the agent must not proceed.
+
+## wrap(): authorize every tool call in one line
+
+```python
+agent = ak.wrap(my_agent)                   # observe (default): records, blocks nothing
+agent = ak.wrap(my_agent, mode="enforce")   # raises AgentKeyDenied on a denial
+```
+
+```js
+const agent = ak.wrap(myAgent);                    // observe (default)
+const agent = ak.wrap(myAgent, { mode: "enforce" }); // raises AgentKeyDenied on a denial
+```
+
+`wrap()` detects an MCP client (`callTool` / `call_tool`), a LangChain agent or tool list, a plain object or dict of functions, or a single function. Observe mode records every call and blocks nothing, so you can see what AgentKey would have caught before trusting it with enforcement. Enforce mode raises `AgentKeyDenied` and does not run the tool. If no session id is passed, a session is started automatically and ended best-effort at process exit.
+
+## Sessions
+
+Every decision and execution is recorded as an evidence event on the session's hash chain. Group a task into one session:
+
+```python
+s = ak.start_session()
+# ... checks and actions ...
+ak.end_session(s["session_id"])
+```
+
+```js
+const s = await ak.startSession();
+// ... checks and actions ...
+await ak.endSession({ sessionId: s.session_id });
+```
+
+## Recording what the agent actually did
+
+After an allowed action runs, record the execution, linked back to its decision by `authorization_id`:
+
+```python
+auth = ak.check_permission(action="send_email", resource="gmail", session_id=sid)
+if auth["allowed"]:
+    send_email(...)
+    ak.record_action(session_id=sid, authorization_id=auth["event_id"], tool="gmail",
+                     action="send_email", resource="gmail", result_status="success")
+```
+
+`record_action` never refuses to record, so evidence is not lost for billing reasons. Actions that run without any authorization decision are surfaced on the dashboard as findings (`executions_without_authorization`), because the SDK is self-reported: an agent that bypasses the wrapped functions produces no evidence.
+
+## guard(): authorize, run, record in one call
+
+```python
+out = ak.guard(sid, "gmail", "send_email", lambda: send_email(...), arguments={"to": "x@company.com"})
+```
+
+```js
+const out = await ak.guard({ sessionId: sid, resource: "gmail", action: "send_email" }, async () => sendEmail());
+```
+
+If authorize denies, `guard` returns the denial and does not run the function.
+
+## Delegated authorization
+
+A parent agent can delegate a scoped subset of its permissions to a child agent. Scopes are `resource:action` strings, must be a subset of the parent's own permissions, and chains are depth-limited. See `delegate()` in the source docstrings.
+
+## Production API
+
+Base URL: `https://agentkey.base44.app` (the SDK default). Override it with `base_url` (Python) or `baseUrl` (JavaScript) if you self-host.
+
+All endpoints are POST with a Bearer API key, under `/api/functions/`:
+
+- `authorize`
+- `record_action`
+- `start_session`
+- `end_session`
+- `delegate`
+- `validate_api_key` (GET)
+
+Raw HTTP:
+
+```bash
+curl -X POST https://agentkey.base44.app/api/functions/authorize \
+  -H "Authorization: Bearer agent_live_xxxxx" \
+  -H "Content-Type: application/json" \
+  -d '{"action":"send_email","resource":"gmail","arguments":{"to":"x@company.com"}}'
+```
+
+## Dashboard
+
+Sessions, evidence events, approvals, findings and permission settings: https://agentkey.base44.app
+
+## Security limitations (current, accurate)
+
+- Evidence events are hash-chained per session, and session Merkle roots are attested with HMAC-SHA256 under a server-side key. This detects altered or missing events in stored evidence. It is not an asymmetric digital signature scheme, it does not make records forgery-proof against a compromised server, and it is not a non-repudiation guarantee.
+- SDK instrumentation is self-reported. `wrap()` and `record_action` record what the agent reports; an agent that calls tools outside the SDK produces no evidence. This is reported as an `executions_without_authorization` finding, but not prevented.
+- Checks fail closed on network errors and timeouts. In observe mode the SDK still lets the call run; only enforce mode blocks it.
+- No SOC 2 or other third-party compliance audit has been completed.
+
+License: MIT.

agentkey-1.0.0/agentkey.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+LICENSE
+README.md
+agentkey.py
+pyproject.toml
+agentkey.egg-info/PKG-INFO
+agentkey.egg-info/SOURCES.txt
+agentkey.egg-info/dependency_links.txt
+agentkey.egg-info/top_level.txt
+tests/test_agentkey.py

agentkey-1.0.0/agentkey.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

agentkey-1.0.0/agentkey.egg-info/top_level.txt

@@ -0,0 +1 @@
+agentkey

agentkey-1.0.0/agentkey.py

@@ -0,0 +1,432 @@
+"""AgentKey — minimal Python SDK. Zero dependencies (stdlib only). Drop into your project.
+
+One-line install: wrap an existing agent and AgentKey records every tool call
+as paired authorization + execution evidence — no call-site changes.
+
+    from agentkey import AgentKeyClient
+    ak = AgentKeyClient(api_key="agent_live_xxxxx")  # base_url defaults to the production API
+    agent = ak.wrap(my_agent)            # observe mode (default): records, blocks nothing
+    # agent = ak.wrap(my_agent, mode="enforce")  # raises AgentKeyDenied on a denial
+
+Fail-closed: if the AgentKey service cannot return a valid decision within 5
+seconds (network error, timeout, non-JSON body, or a response missing the
+`allowed` field), every check returns {"allowed": False, "reason":
+"agentkey_unreachable", "fail_closed": True} so an agent never proceeds on a
+missing or ambiguous decision.
+"""
+
+import json
+import hashlib
+import time
+import sys
+import atexit
+import functools
+import urllib.request
+import urllib.error
+
+FAIL_CLOSED = {"allowed": False, "reason": "agentkey_unreachable", "fail_closed": True}
+TIMEOUT = 5.0
+
+# Production API. Override with base_url=... only if you self-host.
+DEFAULT_BASE_URL = "https://agentkey.base44.app"
+
+# The production API sits behind a WAF that blocks library-default User-Agent
+# strings (Python-urllib/*). Identify the SDK with a self-describing agent so
+# requests are not rejected as bot traffic.
+USER_AGENT = "Mozilla/5.0 (compatible; agentkey-python-sdk/1.0.0; +https://agentkey.base44.app)"
+
+_wrap_first_run = {"done": False}
+
+
+class AgentKeyDenied(Exception):
+    """Raised in enforce mode when AgentKey denies a wrapped tool call."""
+    def __init__(self, reason="denied by AgentKey policy", result=None):
+        super().__init__(reason)
+        self.reason = reason
+        self.result = result
+
+
+class AgentKeyClient:
+    def __init__(self, api_key, base_url=DEFAULT_BASE_URL):
+        if not api_key:
+            raise ValueError("AgentKey: api_key is required")
+        self.api_key = api_key
+        self.base_url = base_url.rstrip("/")
+
+    def _post(self, path, body, extra_headers=None):
+        url = f"{self.base_url}{path}"
+        data = json.dumps(body).encode("utf-8")
+        headers = {"Content-Type": "application/json", "User-Agent": USER_AGENT}
+        if extra_headers:
+            headers.update(extra_headers)
+        req = urllib.request.Request(url, data=data, headers=headers, method="POST")
+        parsed = None
+        try:
+            with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
+                parsed = json.loads(resp.read().decode("utf-8"))
+        except urllib.error.HTTPError as e:
+            try:
+                parsed = json.loads(e.read().decode("utf-8"))
+            except Exception:
+                return dict(FAIL_CLOSED)
+        except Exception:
+            return dict(FAIL_CLOSED)
+        if not isinstance(parsed, dict) or "allowed" not in parsed:
+            return dict(FAIL_CLOSED)
+        return parsed
+
+    def _post_json(self, path, body, extra_headers=None):
+        url = f"{self.base_url}{path}"
+        data = json.dumps(body).encode("utf-8")
+        headers = {"Content-Type": "application/json", "User-Agent": USER_AGENT}
+        if extra_headers:
+            headers.update(extra_headers)
+        req = urllib.request.Request(url, data=data, headers=headers, method="POST")
+        try:
+            with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
+                return json.loads(resp.read().decode("utf-8"))
+        except urllib.error.HTTPError as e:
+            try:
+                return json.loads(e.read().decode("utf-8"))
+            except Exception:
+                return {"error": "agentkey_unreachable"}
+        except Exception:
+            return {"error": "agentkey_unreachable"}
+
+    def check_permission(self, action, resource, metadata=None, tool=None,
+                         arguments=None, session_id=None, parent_event_id=None,
+                         parent_agent_id=None, source=None, scan_id=None,
+                         delegation_id=None):
+        """Evaluate a permission. Returns a dict with allowed, reason, request_id,
+        session_id, event_id, usage, plan. Fails closed on any error/timeout.
+        Pass scan_id to link an input scan to this decision (overrides a
+        session-level scan). Pass delegation_id to act under a delegation the
+        child agent received — the whole chain is revalidated server-side."""
+        if not action or not resource:
+            raise ValueError("AgentKey: action and resource are required")
+        return self._post(
+            "/api/functions/authorize",
+            {
+                "action": action, "resource": resource, "tool": tool,
+                "metadata": metadata or {}, "arguments": arguments,
+                "session_id": session_id, "parent_event_id": parent_event_id,
+                "parent_agent_id": parent_agent_id, "source": source,
+                "input_scan_id": scan_id, "delegation_id": delegation_id,
+            },
+            extra_headers={"Authorization": f"Bearer {self.api_key}"},
+        )
+
+    def delegate(self, child_agent_id, scopes, ttl_hours=None, session_id=None,
+                 parent_delegation_id=None):
+        """Delegated authorization: delegate a scoped subset of THIS agent's
+        authority (the caller is the PARENT agent) to a child agent. Scopes are
+        "resource:action" strings and must be a subset of the parent's own
+        permissions — anything broader is blocked server-side (scope escalation
+        prevention). Returns { allowed, decision, delegation_id, scopes_granted,
+        depth, expires_at }. The delegation_id is runtime-minted: the caller can
+        neither choose nor reset it. The child then passes delegation_id to
+        check_permission() to act under the delegation. Fail-closed."""
+        if not child_agent_id or not scopes or not isinstance(scopes, list):
+            raise ValueError("AgentKey: child_agent_id and a non-empty scopes list are required")
+        return self._post_json(
+            "/api/functions/delegate",
+            {
+                "child_agent_id": child_agent_id,
+                "scopes": scopes,
+                "ttl_hours": ttl_hours,
+                "session_id": session_id,
+                "parent_delegation_id": parent_delegation_id,
+            },
+            extra_headers={"Authorization": f"Bearer {self.api_key}"},
+        )
+
+    def validate(self):
+        """Validate the key is active. Fails closed on any error/timeout."""
+        url = f"{self.base_url}/api/functions/validate_api_key"
+        req = urllib.request.Request(
+            url,
+            headers={"Authorization": f"Bearer {self.api_key}", "User-Agent": USER_AGENT},
+        )
+        parsed = None
+        try:
+            with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
+                parsed = json.loads(resp.read().decode("utf-8"))
+        except Exception:
+            return {"valid": False, "reason": "agentkey_unreachable", "fail_closed": True}
+        if not isinstance(parsed, dict) or "valid" not in parsed:
+            return {"valid": False, "reason": "agentkey_unreachable", "fail_closed": True}
+        return parsed
+
+    def start_session(self, metadata=None, scan_id=None):
+        """Start an evidence session. Pass scan_id to attach an input scan once
+        at the start of a task; it is inherited by every decision in the session
+        unless overridden per call. Returns { session_id, agent_id, started_at,
+        preceding_scan_id }."""
+        return self._post_json(
+            "/api/functions/start_session",
+            {"metadata": metadata or {}, "scan_id": scan_id},
+            extra_headers={"Authorization": f"Bearer {self.api_key}"},
+        )
+
+    def end_session(self, session_id, status=None):
+        """End an evidence session. Pass status='failed' to mark it failed."""
+        return self._post_json(
+            "/api/functions/end_session",
+            {"session_id": session_id, "status": status},
+            extra_headers={"Authorization": f"Bearer {self.api_key}"},
+        )
+
+    def record_action(self, session_id, tool, action, result_status, resource=None,
+                       arguments=None, authorization_id=None, result_hash=None,
+                       duration_ms=None, error_message=None, metadata=None,
+                       scan_id=None):
+        """Record what an agent ACTUALLY did, as an execution event on the same hash
+        chain as the decision that permitted it. Self-reported: an agent that does
+        not call it produces no execution evidence — which is exactly why
+        executions_without_authorization is reported. `metadata` is sanitized to
+        primitives before storage (used by wrap() to mark would_block). Pass
+        scan_id to link an input scan to this execution."""
+        return self._post_json(
+            "/api/functions/record_action",
+            {
+                "session_id": session_id, "authorization_id": authorization_id,
+                "tool": tool, "action": action, "resource": resource,
+                "arguments": arguments, "result_status": result_status,
+                "result_hash": result_hash, "duration_ms": duration_ms,
+                "error_message": error_message, "metadata": metadata,
+                "input_scan_id": scan_id,
+            },
+            extra_headers={"Authorization": f"Bearer {self.api_key}"},
+        )
+
+    def _hash_result(self, result):
+        try:
+            return hashlib.sha256(
+                json.dumps(result, sort_keys=True, default=str).encode("utf-8")
+            ).hexdigest()
+        except Exception:
+            return ""
+
+    def guard(self, session_id, resource, action, fn, tool=None, arguments=None,
+              scan_id=None):
+        """Authorize, run ``fn`` if allowed, then record the execution. Pass
+        scan_id to link an input scan to both the decision and the execution."""
+        auth = self.check_permission(action=action, resource=resource, tool=tool,
+                                      arguments=arguments, session_id=session_id,
+                                      scan_id=scan_id)
+        if not auth or not auth.get("allowed"):
+            return auth
+        t0 = time.time()
+        try:
+            result = fn()
+            duration_ms = int((time.time() - t0) * 1000)
+            try:
+                rh = self._hash_result(result)
+                self.record_action(session_id=session_id, tool=tool, action=action,
+                                   resource=resource, arguments=arguments,
+                                   result_status="success", result_hash=rh,
+                                   duration_ms=duration_ms,
+                                   authorization_id=auth.get("event_id"),
+                                   scan_id=scan_id)
+            except Exception:
+                pass
+            return {"allowed": True, "result": result, "authorization": auth}
+        except Exception as e:
+            duration_ms = int((time.time() - t0) * 1000)
+            try:
+                self.record_action(session_id=session_id, tool=tool, action=action,
+                                   resource=resource, arguments=arguments,
+                                   result_status="error", error_message=str(e)[:200],
+                                   duration_ms=duration_ms,
+                                   authorization_id=auth.get("event_id"),
+                                   scan_id=scan_id)
+            except Exception:
+                pass
+            raise
+
+    def wrap(self, target, session_id=None, mode="observe", scan_id=None):
+        """One-line auto-instrumentation. Wraps an existing agent — an MCP client
+        (call_tool), a LangChain agent or tool list (tools[].invoke/run/_call),
+        a plain dict of functions, or a single function — so every tool call is
+        authorized and recorded without changing any call site.
+
+        mode='observe' (default) records everything and blocks nothing; a denial
+        is logged and the call still runs, recorded with would_block=True.
+        mode='enforce' raises AgentKeyDenied on a denial and does NOT run the tool.
+
+        If no session_id is given, a session is started automatically and ended
+        best-effort at process exit (never throws on shutdown). Wrapped functions
+        preserve name/docstring/return value — a wrapped agent behaves identically
+        when everything is allowed.
+
+        wrap() is still self-reported: an agent that bypasses the wrapped
+        functions produces no evidence, which is exactly why
+        executions_without_authorization is reported.
+
+        Pass scan_id to attach an input scan to the auto-started session so
+        every wrapped tool call inherits it."""
+        return _wrap_target(self, target, session_id, mode, scan_id)
+
+
+# --- wrap() internals ---------------------------------------------------------
+
+def _name_of(t, fallback):
+    n = getattr(t, "name", None)
+    if isinstance(n, str) and n:
+        return n
+    return fallback
+
+
+def _get_invoke(t):
+    for m in ("invoke", "run", "_call"):
+        v = getattr(t, m, None)
+        if callable(v):
+            return m
+    return None
+
+
+def _discover(target):
+    # MCP client
+    ct = getattr(target, "call_tool", None)
+    if callable(ct):
+        return [{"name": "call_tool", "host": target, "method": "call_tool", "fn": None, "kind": "mcp"}]
+    if isinstance(target, list):
+        out = []
+        for i, t in enumerate(target):
+            out.append({"name": _name_of(t, f"tool_{i}"), "host": t, "method": _get_invoke(t), "fn": None, "kind": "list"})
+        return out
+    tools = getattr(target, "tools", None)
+    if isinstance(tools, list):
+        out = []
+        for i, t in enumerate(tools):
+            out.append({"name": _name_of(t, f"tool_{i}"), "host": t, "method": _get_invoke(t), "fn": None, "kind": "langchain"})
+        return out
+    if isinstance(target, dict):
+        out = []
+        for name, fn in target.items():
+            if callable(fn):
+                out.append({"name": name, "host": target, "method": None, "fn": fn, "kind": "dict"})
+        return out
+    if callable(target):
+        return [{"name": _name_of(target, "anonymous"), "host": target, "method": None, "fn": target, "kind": "fn"}]
+    return []
+
+
+def _args_to_dict(args, kwargs):
+    if kwargs:
+        return dict(kwargs)
+    if args and isinstance(args[0], dict):
+        return dict(args[0])
+    if args:
+        return {"input": list(args)}
+    return {}
+
+
+def _make_wrapped(client, get_session, mode, name, original):
+    enforce = mode == "enforce"
+
+    @functools.wraps(original)
+    def wrapped(*args, **kwargs):
+        sid = get_session()
+        argobj = _args_to_dict(args, kwargs)
+        try:
+            auth = client.check_permission(action="invoke", resource=name,
+                                            arguments=argobj, session_id=sid)
+        except Exception:
+            auth = {"allowed": False, "reason": "agentkey_unreachable", "fail_closed": True}
+        allowed = bool(auth and auth.get("allowed") is True)
+        if not allowed and enforce:
+            raise AgentKeyDenied(auth.get("reason") if auth else "denied", auth)
+        if not allowed and not enforce:
+            print(f"AgentKey would have blocked this: {auth.get('reason') if auth else 'denied'}", file=sys.stderr)
+        t0 = time.time()
+        meta = {"would_block": True} if not allowed else None
+        try:
+            result = original(*args, **kwargs)
+        except Exception as e:
+            try:
+                client.record_action(session_id=sid, tool=name, action="invoke", resource=name,
+                                     arguments=argobj, result_status="error",
+                                     error_message=str(e)[:200],
+                                     duration_ms=int((time.time() - t0) * 1000),
+                                     authorization_id=auth.get("event_id") if auth else None,
+                                     metadata=meta)
+            except Exception:
+                pass
+            raise
+        try:
+            rh = client._hash_result(result)
+            client.record_action(session_id=sid, tool=name, action="invoke", resource=name,
+                                  arguments=argobj, result_status="success", result_hash=rh,
+                                  duration_ms=int((time.time() - t0) * 1000),
+                                  authorization_id=auth.get("event_id") if auth else None,
+                                  metadata=meta)
+        except Exception:
+            pass
+        return result
+
+    return wrapped
+
+
+def _wrap_target(client, target, session_id, mode, scan_id=None):
+    tools = _discover(target)
+    if not tools:
+        return target
+    auto = session_id is None
+    state = {"session_id": session_id, "booted": False, "ended": False}
+
+    def boot():
+        if state["booted"]:
+            return
+        state["booted"] = True
+        if not state["session_id"]:
+            try:
+                s = client.start_session(scan_id=scan_id)
+                state["session_id"] = s.get("session_id") if s else None
+            except Exception:
+                state["session_id"] = None
+        if not _wrap_first_run["done"]:
+            _wrap_first_run["done"] = True
+            url = f"{client.base_url}/sessions/{state['session_id'] or ''}"
+            try:
+                print(f"AgentKey: session={state['session_id'] or '?'} tools={len(tools)} "
+                      f"mode={'enforce' if mode == 'enforce' else 'observe'} dashboard={url}",
+                      file=sys.stderr)
+            except Exception:
+                pass
+        if auto:
+            try:
+                def _on_shutdown():
+                    if state.get("ended") or not state.get("session_id"):
+                        return
+                    state["ended"] = True
+                    try:
+                        client.end_session(state["session_id"])
+                    except Exception:
+                        pass
+                atexit.register(_on_shutdown)
+            except Exception:
+                pass
+
+    def get_session():
+        boot()
+        return state["session_id"]
+
+    def make(name, original):
+        return _make_wrapped(client, get_session, mode, name, original)
+
+    kinds = {t["kind"] for t in tools}
+    if "dict" in kinds:
+        return {t["name"]: make(t["name"], t["fn"]) for t in tools}
+    if "fn" in kinds:
+        return make(tools[0]["name"], tools[0]["fn"])
+    # list / langchain / mcp: mutate each tool's method in place so an agent
+    # that calls its own tools internally still routes through the wrapper.
+    for t in tools:
+        original = None
+        if t["method"]:
+            original = getattr(t["host"], t["method"], None)
+        if not callable(original):
+            continue
+        setattr(t["host"], t["method"], make(t["name"], original))
+    return target

agentkey-1.0.0/pyproject.toml

@@ -0,0 +1,35 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "agentkey"
+version = "1.0.0"
+description = "Authorization and evidence SDK for AI agents: check permissions before every action, record what agents actually did."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "AgentKey" }]
+keywords = ["ai", "agents", "authorization", "permissions", "audit", "mcp", "security", "llm"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://agentkey.base44.app"
+Documentation = "https://agentkey.base44.app/docs"
+
+[tool.setuptools]
+py-modules = ["agentkey"]

agentkey-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

agentkey-1.0.0/tests/test_agentkey.py

@@ -0,0 +1,179 @@
+import json
+import sys
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+sys.path.insert(0, ".")
+from agentkey import AgentKeyClient, AgentKeyDenied, DEFAULT_BASE_URL, USER_AGENT
+
+
+class _Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length") or 0)
+        body = json.loads(self.rfile.read(length) or b"{}")
+        tool = str((body or {}).get("tool") or "")
+        resource = str((body or {}).get("resource") or "")
+        if resource == "deny_tool":
+            tool = "deny_tool"
+        if self.path == "/html":
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html")
+            self.end_headers()
+            self.wfile.write(b"<html>not json</html>")
+            return
+        if tool == "deny_tool":
+            out = {"allowed": False, "reason": "denied by policy"}
+        elif tool == "ask_tool":
+            out = {"allowed": False, "reason": "approval required", "approval_required": True}
+        elif tool == "echo":
+            out = {"allowed": True, "reason": "ok", "user_agent": self.headers.get("User-Agent")}
+        else:
+            out = {"allowed": True, "reason": "ok", "event_id": "evt_1"}
+        status = 200
+        payload = json.dumps(out).encode("utf-8")
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def log_message(self, *a):
+        pass
+
+
+def _start_server():
+    server = HTTPServer(("127.0.0.1", 0), _Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    return server, f"http://127.0.0.1:{server.server_address[1]}"
+
+
+class TestConstructor(unittest.TestCase):
+    def test_api_key_required(self):
+        with self.assertRaises(ValueError):
+            AgentKeyClient(api_key="")
+
+    def test_default_base_url_is_production(self):
+        self.assertEqual(AgentKeyClient(api_key="k").base_url, DEFAULT_BASE_URL)
+        self.assertEqual(DEFAULT_BASE_URL, "https://agentkey.base44.app")
+
+    def test_base_url_trailing_slash_stripped(self):
+        self.assertEqual(AgentKeyClient(api_key="k", base_url="http://x/").base_url, "http://x")
+
+
+class TestValidation(unittest.TestCase):
+    def setUp(self):
+        self.ak = AgentKeyClient(api_key="k", base_url="http://127.0.0.1:1")
+
+    def test_check_permission_requires_action_and_resource(self):
+        with self.assertRaises(ValueError):
+            self.ak.check_permission(action="", resource="gmail")
+        with self.assertRaises(ValueError):
+            self.ak.check_permission(action="send", resource="")
+
+    def test_delegate_requires_child_and_scopes(self):
+        with self.assertRaises(ValueError):
+            self.ak.delegate("", ["a:b"])
+        with self.assertRaises(ValueError):
+            self.ak.delegate("child", "not-a-list")
+
+
+class TestFailClosed(unittest.TestCase):
+    def setUp(self):
+        self.ak = AgentKeyClient(api_key="k", base_url="http://127.0.0.1:1")
+
+    def test_check_permission_unreachable(self):
+        r = self.ak.check_permission(action="send", resource="gmail")
+        self.assertFalse(r["allowed"])
+        self.assertEqual(r["reason"], "agentkey_unreachable")
+        self.assertTrue(r["fail_closed"])
+
+    def test_validate_unreachable(self):
+        r = self.ak.validate()
+        self.assertFalse(r["valid"])
+        self.assertTrue(r["fail_closed"])
+
+    def test_non_json_body_fails_closed(self):
+        server, base = _start_server()
+        try:
+            ak = AgentKeyClient(api_key="k", base_url=base)
+            r = ak.check_permission(action="send", resource="gmail", tool="t")
+            r2 = ak._post("/html", {})
+            self.assertFalse(r2["allowed"])
+        finally:
+            server.shutdown()
+
+
+class TestLiveServer(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server, cls.base = _start_server()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def test_allow_response(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        r = ak.check_permission(action="send", resource="gmail")
+        self.assertTrue(r["allowed"])
+        self.assertEqual(r["event_id"], "evt_1")
+
+    def test_deny_response(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        r = ak.check_permission(action="send", resource="gmail", tool="deny_tool")
+        self.assertFalse(r["allowed"])
+        self.assertEqual(r["reason"], "denied by policy")
+        self.assertNotIn("fail_closed", r)
+
+    def test_ask_response(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        r = ak.check_permission(action="send", resource="gmail", tool="ask_tool")
+        self.assertFalse(r["allowed"])
+        self.assertTrue(r["approval_required"])
+
+    def test_user_agent_sent(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        r = ak.check_permission(action="send", resource="gmail", tool="echo")
+        self.assertEqual(r["user_agent"], USER_AGENT)
+        self.assertIn("agentkey-python-sdk", r["user_agent"])
+
+    def test_hash_result_deterministic(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        self.assertEqual(ak._hash_result({"a": 1}), ak._hash_result({"a": 1}))
+        self.assertEqual(len(ak._hash_result({"a": 1})), 64)
+
+
+class TestWrap(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server, cls.base = _start_server()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def test_observe_mode_runs_despite_denial(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        tools = ak.wrap({"deny_tool": lambda x: "ran(" + x + ")"}, session_id="sid")
+        self.assertEqual(tools["deny_tool"]("ok"), "ran(ok)")
+
+    def test_enforce_mode_blocks_on_denial(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+        tools = ak.wrap({"deny_tool": lambda x: "should not run"}, mode="enforce", session_id="sid")
+        with self.assertRaises(AgentKeyDenied):
+            tools["deny_tool"]("x")
+
+    def test_wrapped_name_preserved(self):
+        ak = AgentKeyClient(api_key="k", base_url=self.base)
+
+        def my_tool(x):
+            return x
+
+        wrapped = ak.wrap(my_tool)
+        self.assertEqual(wrapped.__name__, "my_tool")
+
+
+if __name__ == "__main__":
+    unittest.main()