iatoolkit 2.21.2__tar.gz → 2.22.0__tar.gz

{iatoolkit-2.21.2/src/iatoolkit.egg-info → iatoolkit-2.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.21.2
+Version: 2.22.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.21.2 → iatoolkit-2.22.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.21.2"
+__version__ = "2.22.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.21.2 → iatoolkit-2.22.0}/src/iatoolkit/infra/call_service.py

@@ -40,15 +40,18 @@ class CallServiceClient:
         endpoint: str,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.get(
-                endpoint,
-                params=params,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.get(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -60,17 +63,20 @@ class CallServiceClient:
             data: Any = None,  # Nuevo argumento para datos crudos/binarios
             params: Optional[Dict[str, Any]] = None,
             headers: Optional[Dict[str, str]] = None,
-            timeout: Union[int, float, Tuple[int, int]] = 10
+            timeout: Union[int, float, Tuple[int, int]] = 10,
+            allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.post(
-                endpoint,
-                params=params,
-                json=json_dict,
-                data=data,  # Pasamos data a requests
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "data": data,  # Pasamos data a requests
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.post(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
 
@@ -82,16 +88,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.put(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.put(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -102,16 +111,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.delete(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.delete(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)
@@ -122,16 +134,19 @@ class CallServiceClient:
         json_dict: Optional[Dict[str, Any]] = None,
         params: Optional[Dict[str, Any]] = None,
         headers: Optional[Dict[str, str]] = None,
-        timeout: Union[int, float, Tuple[int, int]] = 10
+        timeout: Union[int, float, Tuple[int, int]] = 10,
+        allow_redirects: Optional[bool] = None,
     ):
         try:
-            response = requests.patch(
-                endpoint,
-                params=params,
-                json=json_dict,
-                headers=self._merge_headers(headers),
-                timeout=self._normalize_timeout(timeout)
-            )
+            request_kwargs = {
+                "params": params,
+                "json": json_dict,
+                "headers": self._merge_headers(headers),
+                "timeout": self._normalize_timeout(timeout),
+            }
+            if allow_redirects is not None:
+                request_kwargs["allow_redirects"] = allow_redirects
+            response = requests.patch(endpoint, **request_kwargs)
         except RequestException as e:
             raise IAToolkitException(IAToolkitException.ErrorType.REQUEST_ERROR, str(e))
         return self._deserialize_response(response)

{iatoolkit-2.21.2 → iatoolkit-2.22.0}/src/iatoolkit/locales/en.yaml

@@ -1594,7 +1594,7 @@ ui:
     execution_hint_native: "Native tools execute through toolkit runtime code, so there is no editable execution_config here."
     inference_execution_hint: "This tool type does not expose an editable execution_config in the GUI. Use the Output tab to document what the runtime returns."
     native_execution_hint: "This tool type executes through internal runtime code. There is no editable execution_config in this editor."
-    raw_hint: "Edit the full tool definition as YAML. This advanced mode includes parameters, execution_config, output_contract, and routing_profile."
+    raw_hint: "Edit the full tool definition as YAML. This advanced mode includes parameters, execution_config, execution_config.response.model_output, output_contract, and routing_profile."
     raw_footer_hint: "Saving from Raw uses this document as the source of truth for the tool definition."
 
     # Modal
@@ -1613,19 +1613,21 @@ ui:
     parameters_help_btn_title: "Show parameters YAML format"
     http_config_title: "HTTP execution_config"
     http_config_help_btn_title: "Show HTTP execution_config YAML format"
-    http_config_hint: "Required for HTTP tools. Minimum: version: 1, request.method, request.url (HTTPS)."
+    http_config_hint: "Required for HTTP tools. Minimum: version: 1, request.method, request.url (HTTPS by default; HTTP only with private-network opt-in)."
     modal_name_placeholder: "e.g. calculate_tax"
     modal_http_method_label: "HTTP method"
-    modal_http_url_label: "HTTPS URL"
+    modal_http_url_label: "HTTP/HTTPS URL"
     modal_http_url_placeholder: "https://api.example.com/resource"
     parameters_help_title: "Parameters YAML format"
     parameters_help_description: "Define tool input parameters as a JSON Schema object serialized in YAML."
     http_config_help_title: "HTTP execution_config YAML format"
-    http_config_help_description: "Use version: 1 and define request/auth/response. Keep URLs as absolute HTTPS."
+    http_config_help_description: "Use version: 1 and define request/auth/response. Keep URLs as absolute HTTPS unless private-network access is explicitly enabled."
     http_config_help_get_example: "GET example"
     http_config_help_post_example: "POST example (Bearer from secrets_manager)"
     output_contract_title: "Output Contract"
     output_contract_hint: "Optional. Use YAML/JSON to describe the returned artifact, for example kind/image/file/audio/video plus transport and field names such as image_url or download_link."
+    model_output_title: "Model Output"
+    model_output_hint: "Define the final JSON returned to the model after the HTTP response is received. Default mode is raw."
     modal_output_contract_label: "Initial output_contract"
     modal_output_contract_placeholder: "kind: image\nmime_type: image/png\ntransport: signed_url\nurl_field: image_url"
     routing_profile_title: "Routing Profile"
@@ -2591,7 +2593,7 @@ js_messages:
   tool_http_execution_config_version: "execution_config.version must be 1"
   tool_http_execution_config_request_required: "execution_config.request is required"
   tool_http_request_method_invalid: "request.method must be one of GET, POST, PUT, PATCH, DELETE"
-  tool_http_request_url_invalid: "request.url must be an absolute HTTPS URL"
+  tool_http_request_url_invalid: "request.url must be an absolute HTTPS URL unless private-network access is explicitly enabled"
   tool_http_request_timeout_invalid: "request.timeout_ms must be an integer between 1 and 120000"
   tool_http_request_field_object: "request.{field} must be an object"
   tool_http_request_body_object: "request.body must be an object"
@@ -2608,6 +2610,19 @@ js_messages:
   tool_http_response_codes_required: "response.success_status_codes must be a non-empty list"
   tool_http_response_codes_invalid: "response.success_status_codes must contain valid HTTP status codes (100..599)"
   tool_http_response_bytes_invalid: "response.max_response_bytes must be a positive integer"
+  tool_http_model_output_label: "model_output"
+  tool_http_model_output_object: "model_output must be an object"
+  tool_http_model_output_unknown_keys: "model_output has unsupported keys: {keys}"
+  tool_http_model_output_mode_invalid: "model_output.mode must be one of raw, extract, map"
+  tool_http_model_output_path_required: "model_output.path is required when mode=extract"
+  tool_http_model_output_root_invalid: "model_output.root must be a non-empty string"
+  tool_http_model_output_fields_required: "model_output.fields must be a non-empty object when mode=map"
+  tool_http_model_output_field_name_invalid: "model_output.fields must use non-empty field names"
+  tool_http_model_output_field_path_required: "model_output.fields.{field} must define a path"
+  tool_http_model_output_field_description_invalid: "model_output.fields.{field}.description must be a string"
+  tool_http_model_output_field_invalid: "model_output.fields.{field} must be a path string or object"
+  tool_http_model_output_exclude_nulls_invalid: "model_output.exclude_nulls must be a boolean"
+  tool_http_model_output_max_items_invalid: "model_output.max_items must be a positive integer"
   tool_error_loading_tools: "Error loading tools"
   tool_no_tools_found: "No tools found."
   tool_pack_read_only: "PACK tools are read-only. Use Clone to USER."

{iatoolkit-2.21.2 → iatoolkit-2.22.0}/src/iatoolkit/locales/es.yaml

@@ -1598,7 +1598,7 @@ ui:
     execution_hint_native: "Las tools nativas se ejecutan en código interno del runtime, por eso aquí no existe un execution_config editable."
     inference_execution_hint: "Este tipo de tool no expone un execution_config editable en la GUI. Usa el tab Output para documentar qué devuelve el runtime."
     native_execution_hint: "Este tipo de tool se ejecuta mediante código interno del runtime. No hay un execution_config editable en este editor."
-    raw_hint: "Edita la definición completa de la tool como YAML. Este modo avanzado incluye parameters, execution_config, output_contract y routing_profile."
+    raw_hint: "Edita la definición completa de la tool como YAML. Este modo avanzado incluye parameters, execution_config, execution_config.response.model_output, output_contract y routing_profile."
     raw_footer_hint: "Guardar desde Raw usa este documento como source of truth de la definición de la tool."
 
     # Modal
@@ -1617,19 +1617,21 @@ ui:
     parameters_help_btn_title: "Mostrar formato YAML de parámetros"
     http_config_title: "execution_config HTTP"
     http_config_help_btn_title: "Mostrar formato YAML de execution_config HTTP"
-    http_config_hint: "Requerido para herramientas HTTP. Mínimo: version: 1, request.method, request.url (HTTPS)."
+    http_config_hint: "Requerido para herramientas HTTP. Mínimo: version: 1, request.method, request.url (HTTPS por defecto; HTTP solo con opt-in de red privada)."
     modal_name_placeholder: "ej. calcular_impuestos"
     modal_http_method_label: "Método HTTP"
-    modal_http_url_label: "URL HTTPS"
+    modal_http_url_label: "URL HTTP/HTTPS"
     modal_http_url_placeholder: "https://api.ejemplo.com/recurso"
     parameters_help_title: "Formato YAML de parámetros"
     parameters_help_description: "Define parámetros de entrada de la herramienta como un objeto JSON Schema serializado en YAML."
     http_config_help_title: "Formato YAML de execution_config HTTP"
-    http_config_help_description: "Usa version: 1 y define request/auth/response. Mantén URLs HTTPS absolutas."
+    http_config_help_description: "Usa version: 1 y define request/auth/response. Mantén URLs HTTPS absolutas salvo que habilites acceso a red privada explícitamente."
     http_config_help_get_example: "Ejemplo GET"
     http_config_help_post_example: "Ejemplo POST (Bearer desde secrets_manager)"
     output_contract_title: "Output Contract"
     output_contract_hint: "Opcional. Usa YAML/JSON para describir el artefacto devuelto, por ejemplo kind/image/file/audio/video más transport y nombres de campos como image_url o download_link."
+    model_output_title: "Model Output"
+    model_output_hint: "Define el JSON final que recibe el modelo después de ejecutar la tool HTTP. El modo por defecto es raw."
     modal_output_contract_label: "output_contract inicial"
     modal_output_contract_placeholder: "kind: image\nmime_type: image/png\ntransport: signed_url\nurl_field: image_url"
     routing_profile_title: "Routing Profile"
@@ -2594,7 +2596,7 @@ js_messages:
   tool_http_execution_config_version: "execution_config.version debe ser 1"
   tool_http_execution_config_request_required: "execution_config.request es obligatorio"
   tool_http_request_method_invalid: "request.method debe ser uno de GET, POST, PUT, PATCH, DELETE"
-  tool_http_request_url_invalid: "request.url debe ser una URL HTTPS absoluta"
+  tool_http_request_url_invalid: "request.url debe ser una URL HTTPS absoluta salvo que el acceso a red privada esté habilitado explícitamente"
   tool_http_request_timeout_invalid: "request.timeout_ms debe ser un entero entre 1 y 120000"
   tool_http_request_field_object: "request.{field} debe ser un objeto"
   tool_http_request_body_object: "request.body debe ser un objeto"
@@ -2611,6 +2613,19 @@ js_messages:
   tool_http_response_codes_required: "response.success_status_codes debe ser una lista no vacía"
   tool_http_response_codes_invalid: "response.success_status_codes debe contener códigos HTTP válidos (100..599)"
   tool_http_response_bytes_invalid: "response.max_response_bytes debe ser un entero positivo"
+  tool_http_model_output_label: "model_output"
+  tool_http_model_output_object: "model_output debe ser un objeto"
+  tool_http_model_output_unknown_keys: "model_output tiene claves no soportadas: {keys}"
+  tool_http_model_output_mode_invalid: "model_output.mode debe ser uno de raw, extract, map"
+  tool_http_model_output_path_required: "model_output.path es obligatorio cuando mode=extract"
+  tool_http_model_output_root_invalid: "model_output.root debe ser un string no vacío"
+  tool_http_model_output_fields_required: "model_output.fields debe ser un objeto no vacío cuando mode=map"
+  tool_http_model_output_field_name_invalid: "model_output.fields debe usar nombres de campo no vacíos"
+  tool_http_model_output_field_path_required: "model_output.fields.{field} debe definir un path"
+  tool_http_model_output_field_description_invalid: "model_output.fields.{field}.description debe ser un string"
+  tool_http_model_output_field_invalid: "model_output.fields.{field} debe ser un path string u objeto"
+  tool_http_model_output_exclude_nulls_invalid: "model_output.exclude_nulls debe ser booleano"
+  tool_http_model_output_max_items_invalid: "model_output.max_items debe ser un entero positivo"
   tool_error_loading_tools: "Error cargando herramientas"
   tool_no_tools_found: "No se encontraron herramientas."
   tool_pack_read_only: "Las herramientas PACK son de solo lectura. Usa Clonar a USER."

{iatoolkit-2.21.2 → iatoolkit-2.22.0}/src/iatoolkit/services/http_tool_service.py

@@ -78,15 +78,49 @@ class HttpToolService:
               json_payload: dict | None,
               timeout):
         if method == "GET":
-            return self.call_service.get(url, params=params, headers=headers, timeout=timeout)
+            return self.call_service.get(
+                url,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "POST":
-            return self.call_service.post(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.post(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "PUT":
-            return self.call_service.put(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.put(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "PATCH":
-            return self.call_service.patch(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.patch(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
         if method == "DELETE":
-            return self.call_service.delete(url, json_dict=json_payload, params=params, headers=headers, timeout=timeout)
+            return self.call_service.delete(
+                url,
+                json_dict=json_payload,
+                params=params,
+                headers=headers,
+                timeout=timeout,
+                allow_redirects=False,
+            )
 
         raise IAToolkitException(
             IAToolkitException.ErrorType.INVALID_PARAMETER,
@@ -182,15 +216,35 @@ class HttpToolService:
 
     def _validate_target_url(self, company_short_name: str, execution_config: dict, url: str):
         parsed = urlparse(url)
+        scheme = parsed.scheme.lower()
         host = (parsed.hostname or "").strip().lower()
+        allow_private_network = self._private_network_enabled(execution_config)
+        allowed_hosts = self._resolve_allowed_hosts(
+            company_short_name,
+            execution_config,
+            include_company_defaults=not allow_private_network,
+        )
 
-        if parsed.scheme.lower() != "https" or not host:
+        allowed_schemes = {"https", "http"} if allow_private_network else {"https"}
+        if scheme not in allowed_schemes or not host:
+            message = "HTTP tools require an absolute HTTPS URL"
+            if allow_private_network:
+                message = (
+                    "HTTP tools require an absolute HTTP or HTTPS URL "
+                    "when allow_private_network=true"
+                )
             raise IAToolkitException(
                 IAToolkitException.ErrorType.INVALID_PARAMETER,
-                "HTTP tools require an absolute HTTPS URL"
+                message
             )
 
-        if host == "localhost" or host.endswith(".local"):
+        if allowed_hosts and not self._host_in_allowlist(host, allowed_hosts):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.REQUEST_ERROR,
+                f"HTTP tool target host '{host}' is not in allowed_hosts"
+            )
+
+        if host == "localhost" or (host.endswith(".local") and not allow_private_network):
             raise IAToolkitException(
                 IAToolkitException.ErrorType.REQUEST_ERROR,
                 f"HTTP tool target host '{host}' is not allowed"
@@ -198,16 +252,35 @@ class HttpToolService:
 
         ip_value = self._to_ip_or_none(host)
         if ip_value:
-            self._assert_public_ip(ip_value)
+            classification = self._assert_allowed_ip(ip_value, allow_private_network)
+            if scheme == "http" and classification != "private":
+                raise IAToolkitException(
+                    IAToolkitException.ErrorType.REQUEST_ERROR,
+                    "HTTP scheme is only allowed for private-network HTTP tools"
+                )
         else:
-            self._assert_public_dns_target(host)
+            dns_result = self._assert_dns_target_allowed(host, allow_private_network)
+            if scheme == "http":
+                if not dns_result["resolved"]:
+                    raise IAToolkitException(
+                        IAToolkitException.ErrorType.REQUEST_ERROR,
+                        "HTTP private-network targets must resolve before request"
+                    )
+                if not dns_result["has_private"] or dns_result["has_public"]:
+                    raise IAToolkitException(
+                        IAToolkitException.ErrorType.REQUEST_ERROR,
+                        "HTTP scheme is only allowed for private-network targets"
+                    )
 
-        allowed_hosts = self._resolve_allowed_hosts(company_short_name, execution_config)
-        if allowed_hosts and not self._host_in_allowlist(host, allowed_hosts):
+    @staticmethod
+    def _private_network_enabled(execution_config: dict) -> bool:
+        security_cfg = execution_config.get("security") or {}
+        if not isinstance(security_cfg, dict):
             raise IAToolkitException(
-                IAToolkitException.ErrorType.REQUEST_ERROR,
-                f"HTTP tool target host '{host}' is not in allowed_hosts"
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                "execution_config.security must be a JSON object"
             )
+        return security_cfg.get("allow_private_network") is True
 
     @staticmethod
     def _to_ip_or_none(host: str):
@@ -216,14 +289,15 @@ class HttpToolService:
         except ValueError:
             return None
 
-    def _assert_public_dns_target(self, hostname: str):
+    def _assert_dns_target_allowed(self, hostname: str, allow_private_network: bool) -> dict:
         # Best effort DNS check to reduce SSRF risk when DNS resolves to private ranges.
         try:
             entries = socket.getaddrinfo(hostname, None)
         except Exception:
             # If DNS cannot be resolved here, let the outbound request fail naturally.
-            return
+            return {"resolved": False, "has_private": False, "has_public": False}
 
+        result = {"resolved": False, "has_private": False, "has_public": False}
         for entry in entries:
             sockaddr = entry[4]
             if not sockaddr:
@@ -231,12 +305,18 @@ class HttpToolService:
             ip_text = sockaddr[0]
             ip_value = self._to_ip_or_none(ip_text)
             if ip_value:
-                self._assert_public_ip(ip_value)
+                result["resolved"] = True
+                classification = self._assert_allowed_ip(ip_value, allow_private_network)
+                if classification == "private":
+                    result["has_private"] = True
+                else:
+                    result["has_public"] = True
+
+        return result
 
     @staticmethod
-    def _assert_public_ip(ip_value):
-        if (ip_value.is_private or
-                ip_value.is_loopback or
+    def _assert_allowed_ip(ip_value, allow_private_network: bool) -> str:
+        if (ip_value.is_loopback or
                 ip_value.is_link_local or
                 ip_value.is_reserved or
                 ip_value.is_multicast or
@@ -245,12 +325,23 @@ class HttpToolService:
                 IAToolkitException.ErrorType.REQUEST_ERROR,
                 f"HTTP tool target IP '{ip_value}' is not allowed"
             )
+        if ip_value.is_private:
+            if allow_private_network:
+                return "private"
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.REQUEST_ERROR,
+                f"HTTP tool target IP '{ip_value}' is not allowed"
+            )
+        return "public"
 
-    def _resolve_allowed_hosts(self, company_short_name: str, execution_config: dict) -> list[str]:
+    def _resolve_allowed_hosts(self,
+                               company_short_name: str,
+                               execution_config: dict,
+                               include_company_defaults: bool = True) -> list[str]:
         security_cfg = execution_config.get("security") or {}
         allowed_hosts = security_cfg.get("allowed_hosts")
 
-        if allowed_hosts is None:
+        if allowed_hosts is None and include_company_defaults:
             company_params = self.config_service.get_configuration(company_short_name, "parameters") or {}
             http_tools_cfg = company_params.get("http_tools") or {}
             allowed_hosts = http_tools_cfg.get("allowed_hosts")
@@ -421,6 +512,8 @@ class HttpToolService:
         if extract_path:
             value = self._extract_path(response_data, str(extract_path))
 
+        value = self._apply_model_output(value, response_cfg.get("model_output"))
+
         if mode == "text" and not isinstance(value, str):
             value = json.dumps(value, ensure_ascii=False, default=str)
 
@@ -462,3 +555,94 @@ class HttpToolService:
                 )
 
         return current
+
+    def _apply_model_output(self, value, model_output):
+        if model_output in (None, {}, ""):
+            return value
+        if not isinstance(model_output, dict):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                "execution_config.response.model_output must be a JSON object"
+            )
+
+        mode = str(model_output.get("mode", "raw")).strip().lower()
+        if mode == "raw":
+            return value
+        if mode == "extract":
+            path = str(model_output.get("path") or "").strip()
+            if not path:
+                raise IAToolkitException(
+                    IAToolkitException.ErrorType.INVALID_PARAMETER,
+                    "execution_config.response.model_output.path is required when mode is 'extract'"
+                )
+            return self._extract_path(value, path)
+        if mode == "map":
+            return self._apply_mapped_model_output(value, model_output)
+
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.INVALID_PARAMETER,
+            f"Unsupported execution_config.response.model_output.mode '{mode}'"
+        )
+
+    def _apply_mapped_model_output(self, value, model_output: dict):
+        root_path = str(model_output.get("root") or "").strip()
+        source = self._extract_path(value, root_path) if root_path else value
+        fields = model_output.get("fields") or {}
+        if not isinstance(fields, dict) or not fields:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                "execution_config.response.model_output.fields must be a non-empty object when mode is 'map'"
+            )
+
+        exclude_nulls = model_output.get("exclude_nulls") is True
+        max_items = model_output.get("max_items")
+
+        if isinstance(source, list):
+            items = (
+                source[:max_items]
+                if isinstance(max_items, int) and not isinstance(max_items, bool) and max_items > 0
+                else source
+            )
+            return [
+                self._map_model_output_item(item, fields, exclude_nulls)
+                for item in items
+            ]
+        if isinstance(source, dict):
+            return self._map_model_output_item(source, fields, exclude_nulls)
+
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.INVALID_PARAMETER,
+            f"Cannot map model_output over type '{type(source).__name__}'"
+        )
+
+    def _map_model_output_item(self, source: dict, fields: dict, exclude_nulls: bool) -> dict:
+        mapped = {}
+        for output_name, field_config in fields.items():
+            path = self._resolve_model_output_field_path(output_name, field_config)
+            found, field_value = self._try_extract_path(source, path)
+            if (not found or field_value is None) and exclude_nulls:
+                continue
+            mapped[output_name] = field_value if found else None
+        return mapped
+
+    @staticmethod
+    def _resolve_model_output_field_path(output_name: str, field_config) -> str:
+        if isinstance(field_config, str):
+            path = field_config.strip()
+        elif isinstance(field_config, dict):
+            path = str(field_config.get("path") or "").strip()
+        else:
+            path = ""
+
+        if not path:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.INVALID_PARAMETER,
+                f"execution_config.response.model_output.fields.{output_name} must define a path"
+            )
+        return path
+
+    def _try_extract_path(self, data, extract_path: str):
+        try:
+            return True, self._extract_path(data, extract_path)
+        except IAToolkitException:
+            return False, None