intentseal 0.1.0__tar.gz

intentseal-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

intentseal-0.1.0/NOTICE

@@ -0,0 +1,4 @@
+IntentSeal
+Copyright 2026 Sankalp Wanjari
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).

intentseal-0.1.0/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: intentseal
+Version: 0.1.0
+Summary: IntentSeal: a prompt-injection firewall for AI agents. Inspect what your agent reads, check what it does.
+Author-email: Sankalp Wanjari <sankalpwanjari85@gmail.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/sankalp2515/intentseal
+Project-URL: Source, https://github.com/sankalp2515/intentseal
+Project-URL: Documentation, https://github.com/sankalp2515/intentseal/blob/main/docs/INTEGRATION.md
+Project-URL: Issues, https://github.com/sankalp2515/intentseal/issues
+Keywords: prompt injection,llm security,ai agents,guardrails,firewall,rag,langchain
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: intentseal-core==0.1.0
+Requires-Dist: httpx>=0.27
+Provides-Extra: embedded
+Requires-Dist: intentseal-core[classifiers,engine,ocr]==0.1.0; extra == "embedded"
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.3; extra == "langchain"
+Dynamic: license-file
+
+# IntentSeal
+
+**A prompt-injection firewall for AI agents.** IntentSeal inspects everything your agent reads (user messages, web
+pages, PDFs, Word files, emails, Markdown, HTML, API responses, OCR text, source code, images, retrieved RAG passages)
+before the model sees it, and checks every tool call before it runs. It keeps the agent inside the user's intent.
+
+- **Detects and neutralises** instruction override, role change, secret extraction, tool abuse, credential theft,
+  context poisoning, multi-step jailbreaks, encoded instructions and indirect prompt injection. Every decision is
+  labelled with the attack type.
+- **Sees what the model sees**: hidden text in PDFs and Word files, CSS-hidden HTML, HTML-only email parts, look-alike
+  letters and encoded payloads (base64, hex, %-encoding, Unicode tags) are decoded and checked.
+- **Rules decide, AI advises**: fast structural rules and a local classifier first, an AI judge only when needed, and
+  deterministic action rules (allow-lists, pinned fields, outbound secret scan, "did the user ask for this?") that a
+  model can never override.
+- **Any model provider**: the SDK checks content and tools, not the model call, so it works with OpenAI, Anthropic,
+  Gemini, Groq, Mistral, local models or anything else.
+
+> Status: alpha (0.1). APIs may change between minor versions.
+
+## Install
+
+```bash
+pip install intentseal                 # talks to an IntentSeal gateway (remote mode): small install
+pip install "intentseal[embedded]"     # runs the engine in your process (PDF/Word/HTML extraction, classifier, OCR)
+pip install "intentseal[langchain]"    # LangChain / LangGraph tool helper
+```
+
+Python 3.11+.
+
+## Quickstart (embedded)
+
+```bash
+intentseal init --agent my-agent --template research-assistant    # writes ~/.intentseal/policies/my-agent.yaml
+intentseal init --list                                             # other templates (RAG, support, coding agent)
+```
+
+Add one provider key for the AI judge to `~/.intentseal/.env` or your project's `.env` (`GROQ_API_KEY`,
+`GEMINI_API_KEY`, `NVIDIA_API_KEY` or `OPENROUTER_API_KEY`). Then:
+
+```python
+from intentseal import Guard
+
+guard = Guard("my-agent")
+
+with guard.session(user_id="u-42", task=user_message):
+    page = guard.inspect(html, source="web")                       # cleaned content, or a short safe notice
+    doc = guard.inspect(pdf_bytes, source="pdf", filename="q3.pdf")  # raw bytes: hidden text is seen too
+
+    @guard.tool()                                                  # arguments checked before it runs
+    def send_message(to: str, subject: str, body: str): ...
+
+    send_message(to="someone@elsewhere.example", subject="...", body="...")   # blocked: returns a notice
+```
+
+The policy (`~/.intentseal/policies/my-agent.yaml`) lists your agent's tools with their risk, allow-lists (recipients,
+domains, paths), pinned fields and the words that count as the user asking for an action. Any tool not listed is
+blocked in enforce mode; `mode: monitor` records everything and blocks nothing.
+
+## Remote mode (a shared gateway, Console, audit trail)
+
+```python
+guard = Guard("my-agent", remote="https://intentseal.example.com", api_key=os.environ["INTENTSEAL_KEY"])
+```
+
+Same API; decisions come from the gateway, which also offers an OpenAI- and Anthropic-compatible **LLM proxy** (protect
+an agent by changing its base URL only), a Security Console (decisions, approvals, session replay, policy) and SIEM
+export.
+
+## RAG
+
+Check files when you index them and passages when you retrieve them:
+
+```python
+r = guard.inspect_result(open(path, "rb").read(), source="rag", filename=path)
+if r.enforced.value in ("BLOCK", "ESCALATE"):
+    quarantine(path)                                               # never enters the index
+else:
+    index(r.cleaned_content)
+
+with guard.session(user_id=user.id, task=question):
+    passages = [guard.inspect(c.text, source="rag") for c in retriever.search(question)]
+```
+
+## LangChain / LangGraph
+
+```python
+tools = guard.protect_tools([search_tool, email_tool])             # inputs checked, outputs inspected
+```
+
+## Links
+
+Source, documentation, evaluation results and the gateway: https://github.com/sankalp2515/intentseal
+
+Licensed under the Apache License 2.0.

intentseal-0.1.0/README.md

@@ -0,0 +1,94 @@
+# IntentSeal
+
+**A prompt-injection firewall for AI agents.** IntentSeal inspects everything your agent reads (user messages, web
+pages, PDFs, Word files, emails, Markdown, HTML, API responses, OCR text, source code, images, retrieved RAG passages)
+before the model sees it, and checks every tool call before it runs. It keeps the agent inside the user's intent.
+
+- **Detects and neutralises** instruction override, role change, secret extraction, tool abuse, credential theft,
+  context poisoning, multi-step jailbreaks, encoded instructions and indirect prompt injection. Every decision is
+  labelled with the attack type.
+- **Sees what the model sees**: hidden text in PDFs and Word files, CSS-hidden HTML, HTML-only email parts, look-alike
+  letters and encoded payloads (base64, hex, %-encoding, Unicode tags) are decoded and checked.
+- **Rules decide, AI advises**: fast structural rules and a local classifier first, an AI judge only when needed, and
+  deterministic action rules (allow-lists, pinned fields, outbound secret scan, "did the user ask for this?") that a
+  model can never override.
+- **Any model provider**: the SDK checks content and tools, not the model call, so it works with OpenAI, Anthropic,
+  Gemini, Groq, Mistral, local models or anything else.
+
+> Status: alpha (0.1). APIs may change between minor versions.
+
+## Install
+
+```bash
+pip install intentseal                 # talks to an IntentSeal gateway (remote mode): small install
+pip install "intentseal[embedded]"     # runs the engine in your process (PDF/Word/HTML extraction, classifier, OCR)
+pip install "intentseal[langchain]"    # LangChain / LangGraph tool helper
+```
+
+Python 3.11+.
+
+## Quickstart (embedded)
+
+```bash
+intentseal init --agent my-agent --template research-assistant    # writes ~/.intentseal/policies/my-agent.yaml
+intentseal init --list                                             # other templates (RAG, support, coding agent)
+```
+
+Add one provider key for the AI judge to `~/.intentseal/.env` or your project's `.env` (`GROQ_API_KEY`,
+`GEMINI_API_KEY`, `NVIDIA_API_KEY` or `OPENROUTER_API_KEY`). Then:
+
+```python
+from intentseal import Guard
+
+guard = Guard("my-agent")
+
+with guard.session(user_id="u-42", task=user_message):
+    page = guard.inspect(html, source="web")                       # cleaned content, or a short safe notice
+    doc = guard.inspect(pdf_bytes, source="pdf", filename="q3.pdf")  # raw bytes: hidden text is seen too
+
+    @guard.tool()                                                  # arguments checked before it runs
+    def send_message(to: str, subject: str, body: str): ...
+
+    send_message(to="someone@elsewhere.example", subject="...", body="...")   # blocked: returns a notice
+```
+
+The policy (`~/.intentseal/policies/my-agent.yaml`) lists your agent's tools with their risk, allow-lists (recipients,
+domains, paths), pinned fields and the words that count as the user asking for an action. Any tool not listed is
+blocked in enforce mode; `mode: monitor` records everything and blocks nothing.
+
+## Remote mode (a shared gateway, Console, audit trail)
+
+```python
+guard = Guard("my-agent", remote="https://intentseal.example.com", api_key=os.environ["INTENTSEAL_KEY"])
+```
+
+Same API; decisions come from the gateway, which also offers an OpenAI- and Anthropic-compatible **LLM proxy** (protect
+an agent by changing its base URL only), a Security Console (decisions, approvals, session replay, policy) and SIEM
+export.
+
+## RAG
+
+Check files when you index them and passages when you retrieve them:
+
+```python
+r = guard.inspect_result(open(path, "rb").read(), source="rag", filename=path)
+if r.enforced.value in ("BLOCK", "ESCALATE"):
+    quarantine(path)                                               # never enters the index
+else:
+    index(r.cleaned_content)
+
+with guard.session(user_id=user.id, task=question):
+    passages = [guard.inspect(c.text, source="rag") for c in retriever.search(question)]
+```
+
+## LangChain / LangGraph
+
+```python
+tools = guard.protect_tools([search_tool, email_tool])             # inputs checked, outputs inspected
+```
+
+## Links
+
+Source, documentation, evaluation results and the gateway: https://github.com/sankalp2515/intentseal
+
+Licensed under the Apache License 2.0.

intentseal-0.1.0/intentseal/__init__.py

@@ -0,0 +1,7 @@
+"""IntentSeal Python SDK."""
+
+from intentseal_core.types import ActionResult, Decision, InspectResult
+
+from .guard import Guard, ToolBlocked
+
+__all__ = ["Guard", "ToolBlocked", "Decision", "InspectResult", "ActionResult"]

intentseal-0.1.0/intentseal/guard.py

@@ -0,0 +1,255 @@
+"""Python SDK (SDK-1…SDK-5): protect an existing agent with a few lines.
+
+    guard = Guard("research-agent")                       # SDK-1 embedded mode (engine in-process)
+    guard = Guard("research-agent", remote="https://gw", api_key=...)   # SDK-6 remote mode (Gateway API)
+    tools = guard.protect_tools(langchain_tools)          # SDK-7 LangChain / LangGraph tools
+    with guard.session(user_id="u1", task="Summarise my inbox", trusted={"customer_id": "C-1042"}):   # SDK-4
+        text = guard.inspect(raw_bytes, source="pdf", filename="report.pdf")                          # SDK-2
+        send_email(to=..., body=...)                       # decorated with @guard.tool()              # SDK-3
+
+Failure policy (SDK-5): if the engine itself fails, tools marked `failure: closed` in the policy (write/send)
+are blocked, and `failure: open` tools (read-only) proceed; both are logged.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextvars
+import functools
+import inspect
+import logging
+from contextlib import contextmanager
+from typing import TYPE_CHECKING, Any, Callable, Iterator
+
+from intentseal_core.policy import AgentPolicy, load_policy, policy_exists, policy_path
+from intentseal_core.session import Session
+from intentseal_core.types import ActionResult, Decision, InspectResult
+
+if TYPE_CHECKING:
+    from intentseal_core.engine import Engine
+
+log = logging.getLogger("intentseal.sdk")
+_current: contextvars.ContextVar[Session | None] = contextvars.ContextVar("intentseal_session", default=None)
+
+
+class ToolBlocked(Exception):
+    """Raised by a guarded tool when `on_block="raise"`."""
+
+    def __init__(self, result: ActionResult) -> None:
+        super().__init__(result.notice or result.reason)
+        self.result = result
+
+
+class Guard:
+    def __init__(self, agent_id: str, engine: Engine | None = None, mode: str | None = None,
+                 policy: AgentPolicy | None = None, secrets: list[str] | None = None,
+                 engine_options: dict[str, Any] | None = None, warm_up: bool = True,
+                 remote: str | None = None, api_key: str | None = None, http_client: Any = None) -> None:
+        self.agent_id = agent_id
+        if remote or http_client is not None:   # SDK-6: decisions come from the Gateway API
+            from .remote import RemoteEngine
+            engine = RemoteEngine(remote or "http://gateway", api_key or "", client=http_client)
+            policy = policy or engine.policy(agent_id)   # failure policy (SDK-5) uses the gateway's tool settings
+            warm_up = False
+        if engine is None:
+            # Embedded mode runs the engine in-process; remote mode (above) needs only the light install.
+            try:
+                from intentseal_core.engine import Engine
+                from intentseal_core.llm.router import Router
+            except ImportError as e:
+                raise ImportError(
+                    f"Embedded mode needs the engine: pip install 'intentseal[embedded]' (missing: {e.name}). "
+                    "Or use a gateway: Guard(agent_id, remote='https://<gateway>', api_key=...).") from e
+        if policy is None and remote is None and http_client is None and not policy_exists(agent_id):
+            log.warning("No policy file for agent '%s' (%s): the default policy runs in monitor mode, so nothing is "
+                        "enforced. Create one with `intentseal init --agent %s`, or pass mode='enforce'.",
+                        agent_id, policy_path(agent_id), agent_id)
+        self._policy = policy or load_policy(agent_id)
+        if mode:
+            self._policy.mode = mode
+        if engine is None:
+            router = Router()   # shares the persistent store (settings.db_path) for usage, cache and decisions
+            opts = {"tier0_timeout_s": 10.0, **(engine_options or {})}   # extraction incl. OCR on CPU
+            engine = Engine(policy_loader=self._load, router=router, store=router.store, **opts)
+        self.engine = engine
+        if secrets:
+            self.engine.register_secrets(secrets)
+        if warm_up:
+            _warm_up()
+
+    def _load(self, agent_id: str) -> AgentPolicy:
+        return self._policy if agent_id == self.agent_id else load_policy(agent_id)
+
+    @property
+    def policy(self) -> AgentPolicy:
+        return self._policy
+
+    # ---- sessions (SDK-4) --------------------------------------------------------------------
+    @contextmanager
+    def session(self, user_id: str | None = None, task: str = "", trusted: dict[str, Any] | None = None) -> Iterator[Session]:
+        s = self.engine.start_session(self.agent_id, user_ref=user_id, task=task, trusted=trusted)
+        token = _current.set(s)
+        try:
+            yield s
+        finally:
+            _current.reset(token)
+
+    def start_session(self, user_id: str | None = None, task: str = "", trusted: dict[str, Any] | None = None) -> Session:
+        s = self.engine.start_session(self.agent_id, user_ref=user_id, task=task, trusted=trusted)
+        _current.set(s)
+        return s
+
+    @property
+    def current_session(self) -> Session | None:
+        return _current.get()
+
+    def _sid(self, session_id: str | None) -> str | None:
+        if session_id:
+            return session_id
+        s = _current.get()
+        return s.session_id if s else None
+
+    def register_secrets(self, values: list[str]) -> None:
+        self.engine.register_secrets(values)
+
+    # ---- inbound content (SDK-2) -------------------------------------------------------------
+    async def ainspect_result(self, content: bytes | str, source: str, filename: str | None = None,
+                              session_id: str | None = None) -> InspectResult:
+        return await self.engine.inspect(content, source, self.agent_id, session_id=self._sid(session_id),
+                                         filename=filename)
+
+    async def ainspect(self, content: bytes | str, source: str, filename: str | None = None,
+                       session_id: str | None = None) -> str:
+        """Return what the agent should see: cleaned content, or a safe notice when blocked."""
+        try:
+            r = await self.ainspect_result(content, source, filename, session_id)
+        except Exception as e:  # inspection unavailable (e.g. remote gateway down): never pass content unseen
+            log.warning("inspection failed for %s (%s); content withheld", source, type(e).__name__)
+            return f"[Content from {source} was withheld: the security check is unavailable]"
+        if r.enforced == Decision.ALLOW and isinstance(content, str):
+            return content   # allowed text passes unchanged (G3b); files return their extracted view
+        if r.enforced == Decision.BLOCK:
+            return f"[Content from {source} was withheld by the security policy: {r.reason}]"
+        if r.enforced == Decision.ESCALATE:
+            return f"[Content from {source} is held for human review: {r.reason}]"
+        return r.cleaned_content
+
+    def inspect(self, content: bytes | str, source: str, filename: str | None = None, session_id: str | None = None) -> str:
+        return _run(self.ainspect(content, source, filename, session_id))
+
+    def inspect_result(self, content: bytes | str, source: str, filename: str | None = None,
+                       session_id: str | None = None) -> InspectResult:
+        return _run(self.ainspect_result(content, source, filename, session_id))
+
+    # ---- the model's answer -------------------------------------------------------------------
+    async def acheck_output(self, text: str, session_id: str | None = None) -> str:
+        """What the user may see of the model's final answer: protected values (canaries, registered secrets, known
+        secret formats, also encoded) are redacted, or the answer is withheld when they cannot be."""
+        try:
+            r = await self.engine.check_output(text, self.agent_id, session_id=self._sid(session_id))
+        except Exception as e:   # the check is unavailable: the answer is not known to be safe
+            log.warning("answer check failed (%s); answer withheld", type(e).__name__)
+            return "[The answer was withheld: the security check is unavailable]"
+        return r.cleaned_content
+
+    def check_output(self, text: str, session_id: str | None = None) -> str:
+        return _run(self.acheck_output(text, session_id))
+
+    # ---- actions (SDK-3, SDK-5) --------------------------------------------------------------
+    async def acheck(self, tool: str, args: dict[str, Any], session_id: str | None = None) -> ActionResult:
+        try:
+            return await self.engine.check_action(tool, args, self.agent_id, session_id=self._sid(session_id))
+        except Exception as e:  # engine failure: apply the tool's failure policy
+            tp = self._policy.tools.get(tool)
+            closed = (tp.failure if tp else "closed") == "closed"
+            log.warning("guard check failed for %s (%s); failing %s", tool, type(e).__name__, "closed" if closed else "open")
+            d = Decision.BLOCK if closed else Decision.ALLOW
+            return ActionResult(decision=d, enforced=d, final_args=None if closed else dict(args), degraded=True,
+                                policy_rule=f"guard-failure-fail-{'closed' if closed else 'open'}",
+                                reason=f"guard unavailable ({type(e).__name__})",
+                                notice=f"Action '{tool}' was not performed: the security check is unavailable." if closed else None)
+
+    def check(self, tool: str, args: dict[str, Any], session_id: str | None = None) -> ActionResult:
+        return _run(self.acheck(tool, args, session_id))
+
+    def tool(self, name: str | None = None, pinned: dict[str, Any] | None = None,
+             on_block: str = "notice") -> Callable[[Callable[..., Any]], Callable[..., Any]]:
+        """Decorate a tool function. Arguments are checked (and pinned fields rewritten) before it runs.
+
+        pinned: extra trusted values for this tool's arguments, merged into the session's trusted context.
+        on_block: "notice" returns the guard's notice string; "raise" raises ToolBlocked.
+        """
+
+        def deco(fn: Callable[..., Any]) -> Callable[..., Any]:
+            tool_name = name or fn.__name__
+            sig = inspect.signature(fn)
+
+            def bind(args: tuple, kwargs: dict) -> dict[str, Any]:
+                b = sig.bind_partial(*args, **kwargs)
+                return dict(b.arguments)
+
+            def apply_pins() -> None:
+                s = _current.get()
+                if s is not None and pinned:
+                    s.trusted.update(pinned)
+                    s.note_trusted(" ".join(str(v) for v in pinned.values()))
+
+            def blocked(r: ActionResult) -> Any:
+                if on_block == "raise":
+                    raise ToolBlocked(r)
+                return r.notice or f"Action '{tool_name}' was blocked by the security policy."
+
+            if inspect.iscoroutinefunction(fn):
+                @functools.wraps(fn)
+                async def awrapper(*args: Any, **kwargs: Any) -> Any:
+                    apply_pins()
+                    r = await self.acheck(tool_name, bind(args, kwargs))
+                    if r.enforced != Decision.ALLOW:
+                        return blocked(r)
+                    return await fn(**(r.final_args or {}))
+                return awrapper
+
+            @functools.wraps(fn)
+            def wrapper(*args: Any, **kwargs: Any) -> Any:
+                apply_pins()
+                r = self.check(tool_name, bind(args, kwargs))
+                if r.enforced != Decision.ALLOW:
+                    return blocked(r)
+                return fn(**(r.final_args or {}))
+            return wrapper
+
+        return deco
+
+
+    def protect_tools(self, tools: Any, inspect_outputs: bool = True) -> list[Any]:
+        """SDK-7: wrap LangChain / LangGraph tools (see intentseal.langchain)."""
+        from .langchain import protect_tools
+        return protect_tools(self, tools, inspect_outputs)
+
+
+def _warm_up() -> None:
+    """Load the local classifier and OCR once so the first real inspection is not slowed down."""
+    try:
+        import io
+
+        from PIL import Image, ImageDraw
+
+        from intentseal_core import extract as _extract
+        from intentseal_core.classifier import local_classifier
+
+        local_classifier()
+        img = Image.new("RGB", (160, 40), "white")
+        ImageDraw.Draw(img).text((5, 10), "warm up", fill="black")
+        buf = io.BytesIO()
+        img.save(buf, format="PNG")
+        _extract.extract(buf.getvalue(), fmt="image")
+    except Exception as e:  # warm-up is best effort
+        log.info("warm-up skipped (%s)", type(e).__name__)
+
+
+def _run(coro: Any) -> Any:
+    try:
+        asyncio.get_running_loop()
+    except RuntimeError:
+        return asyncio.run(coro)
+    raise RuntimeError("Guard sync methods cannot run inside an event loop; use the async variants (ainspect/acheck).")

intentseal-0.1.0/intentseal/langchain.py

@@ -0,0 +1,52 @@
+"""LangChain / LangGraph helper (SDK-7): protect an existing tool list in one line.
+
+    from intentseal import Guard
+    guard = Guard("research-agent")
+    tools = guard.protect_tools(tools)          # or: protect_tools(guard, tools)
+    with guard.session(user_id="u1", task=task):
+        agent.invoke(...)
+
+Every call is checked by the action guard before the tool runs (pinned fields rewritten, blocked calls return the
+guard's notice to the model instead of running), and every tool result is inspected as untrusted content before
+the model sees it. The wrapped tools keep their name, description and argument schema, so prompts and
+tool-calling behaviour do not change.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Iterable
+
+from intentseal_core.types import Decision
+
+if TYPE_CHECKING:
+    from langchain_core.tools import BaseTool
+
+    from .guard import Guard
+
+
+def protect_tools(guard: "Guard", tools: Iterable["BaseTool"], inspect_outputs: bool = True) -> list["BaseTool"]:
+    from langchain_core.tools import StructuredTool
+
+    def wrap(t: "BaseTool") -> "BaseTool":
+        async def acall(**kwargs: Any) -> Any:
+            r = await guard.acheck(t.name, kwargs)
+            if r.enforced != Decision.ALLOW:
+                return r.notice or f"Action '{t.name}' was blocked by the security policy."
+            out = await t.ainvoke(r.final_args if r.final_args is not None else kwargs)
+            if inspect_outputs and isinstance(out, str):
+                out = await guard.ainspect(out, source=f"tool:{t.name}")
+            return out
+
+        def call(**kwargs: Any) -> Any:
+            r = guard.check(t.name, kwargs)
+            if r.enforced != Decision.ALLOW:
+                return r.notice or f"Action '{t.name}' was blocked by the security policy."
+            out = t.invoke(r.final_args if r.final_args is not None else kwargs)
+            if inspect_outputs and isinstance(out, str):
+                out = guard.inspect(out, source=f"tool:{t.name}")
+            return out
+
+        return StructuredTool(name=t.name, description=t.description, args_schema=t.args_schema,
+                              func=call, coroutine=acall, return_direct=getattr(t, "return_direct", False))
+
+    return [wrap(t) for t in tools]

intentseal-0.1.0/intentseal/remote.py

@@ -0,0 +1,73 @@
+"""Remote mode (SDK-6): the Guard talks to a Gateway API instead of running the engine in-process.
+
+    guard = Guard("research-agent", remote="https://gateway.example", api_key=os.environ["INTENTSEAL_API_KEY"])
+
+`RemoteEngine` implements the part of the Engine interface the Guard uses (start_session, inspect, check_action,
+register_secrets), so every SDK feature works the same way; decisions are made by the gateway's engine.
+Differences from embedded mode:
+  - the session's trusted context (pinned fields) is fixed when the session is created;
+  - canaries/secrets are configured on the gateway (INTENTSEAL_CANARIES), not registered from the client;
+  - if the gateway is unreachable, content is withheld (fail closed) and tools follow their failure policy (SDK-5).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import logging
+from typing import Any, Iterable
+
+import httpx
+
+from intentseal_core.policy import AgentPolicy
+from intentseal_core.session import Session
+from intentseal_core.types import ActionResult, InspectResult
+
+log = logging.getLogger("intentseal.sdk.remote")
+
+
+class RemoteEngine:
+    def __init__(self, base_url: str, api_key: str, timeout_s: float = 30.0, client: httpx.Client | None = None) -> None:
+        self.http = client or httpx.Client(base_url=base_url.rstrip("/"), timeout=timeout_s)
+        self.headers = {"Authorization": f"Bearer {api_key}"}
+
+    def _post(self, path: str, body: dict[str, Any]) -> dict[str, Any]:
+        r = self.http.post(path, json=body, headers=self.headers)
+        r.raise_for_status()
+        return r.json()
+
+    def policy(self, agent_id: str) -> AgentPolicy:
+        r = self.http.get(f"/v1/policies/{agent_id}", headers=self.headers)
+        r.raise_for_status()
+        return AgentPolicy.model_validate(r.json())
+
+    def register_secrets(self, values: Iterable[str]) -> None:
+        if list(values):
+            log.info("remote mode: secrets/canaries are configured on the gateway (INTENTSEAL_CANARIES), not sent from the client")
+
+    def start_session(self, agent_id: str, user_ref: str | None = None, task: str = "",
+                      trusted: dict[str, Any] | None = None) -> Session:
+        sid = self._post("/v1/sessions", {"agent_id": agent_id, "user_ref": user_ref, "task": task,
+                                          "trusted": dict(trusted or {})})["session_id"]
+        return Session(agent_id=agent_id, session_id=sid, user_ref=user_ref, task=task, trusted=dict(trusted or {}))
+
+    async def inspect(self, content: str | bytes, source: str, agent_id: str, session_id: str | None = None,
+                      filename: str | None = None, fmt: str | None = None, task: str | None = None) -> InspectResult:
+        body: dict[str, Any] = {"source": source, "agent_id": agent_id, "session_id": session_id, "filename": filename}
+        if isinstance(content, bytes):
+            body["content_b64"] = base64.b64encode(content).decode()
+        else:
+            body["content"] = content
+        return InspectResult.model_validate(await asyncio.to_thread(self._post, "/v1/inspect", body))
+
+    async def check_action(self, tool: str, args: dict[str, Any], agent_id: str,
+                           session_id: str | None = None) -> ActionResult:
+        body = {"tool": tool, "args": args, "agent_id": agent_id, "session_id": session_id}
+        return ActionResult.model_validate(await asyncio.to_thread(self._post, "/v1/actions/check", body))
+
+    async def check_output(self, text: str, agent_id: str, session_id: str | None = None) -> InspectResult:
+        body = {"agent_id": agent_id, "session_id": session_id, "text": text}
+        return InspectResult.model_validate(await asyncio.to_thread(self._post, "/v1/outputs/check", body))
+
+    def close(self) -> None:
+        self.http.close()

intentseal-0.1.0/intentseal.egg-info/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: intentseal
+Version: 0.1.0
+Summary: IntentSeal: a prompt-injection firewall for AI agents. Inspect what your agent reads, check what it does.
+Author-email: Sankalp Wanjari <sankalpwanjari85@gmail.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/sankalp2515/intentseal
+Project-URL: Source, https://github.com/sankalp2515/intentseal
+Project-URL: Documentation, https://github.com/sankalp2515/intentseal/blob/main/docs/INTEGRATION.md
+Project-URL: Issues, https://github.com/sankalp2515/intentseal/issues
+Keywords: prompt injection,llm security,ai agents,guardrails,firewall,rag,langchain
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: intentseal-core==0.1.0
+Requires-Dist: httpx>=0.27
+Provides-Extra: embedded
+Requires-Dist: intentseal-core[classifiers,engine,ocr]==0.1.0; extra == "embedded"
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.3; extra == "langchain"
+Dynamic: license-file
+
+# IntentSeal
+
+**A prompt-injection firewall for AI agents.** IntentSeal inspects everything your agent reads (user messages, web
+pages, PDFs, Word files, emails, Markdown, HTML, API responses, OCR text, source code, images, retrieved RAG passages)
+before the model sees it, and checks every tool call before it runs. It keeps the agent inside the user's intent.
+
+- **Detects and neutralises** instruction override, role change, secret extraction, tool abuse, credential theft,
+  context poisoning, multi-step jailbreaks, encoded instructions and indirect prompt injection. Every decision is
+  labelled with the attack type.
+- **Sees what the model sees**: hidden text in PDFs and Word files, CSS-hidden HTML, HTML-only email parts, look-alike
+  letters and encoded payloads (base64, hex, %-encoding, Unicode tags) are decoded and checked.
+- **Rules decide, AI advises**: fast structural rules and a local classifier first, an AI judge only when needed, and
+  deterministic action rules (allow-lists, pinned fields, outbound secret scan, "did the user ask for this?") that a
+  model can never override.
+- **Any model provider**: the SDK checks content and tools, not the model call, so it works with OpenAI, Anthropic,
+  Gemini, Groq, Mistral, local models or anything else.
+
+> Status: alpha (0.1). APIs may change between minor versions.
+
+## Install
+
+```bash
+pip install intentseal                 # talks to an IntentSeal gateway (remote mode): small install
+pip install "intentseal[embedded]"     # runs the engine in your process (PDF/Word/HTML extraction, classifier, OCR)
+pip install "intentseal[langchain]"    # LangChain / LangGraph tool helper
+```
+
+Python 3.11+.
+
+## Quickstart (embedded)
+
+```bash
+intentseal init --agent my-agent --template research-assistant    # writes ~/.intentseal/policies/my-agent.yaml
+intentseal init --list                                             # other templates (RAG, support, coding agent)
+```
+
+Add one provider key for the AI judge to `~/.intentseal/.env` or your project's `.env` (`GROQ_API_KEY`,
+`GEMINI_API_KEY`, `NVIDIA_API_KEY` or `OPENROUTER_API_KEY`). Then:
+
+```python
+from intentseal import Guard
+
+guard = Guard("my-agent")
+
+with guard.session(user_id="u-42", task=user_message):
+    page = guard.inspect(html, source="web")                       # cleaned content, or a short safe notice
+    doc = guard.inspect(pdf_bytes, source="pdf", filename="q3.pdf")  # raw bytes: hidden text is seen too
+
+    @guard.tool()                                                  # arguments checked before it runs
+    def send_message(to: str, subject: str, body: str): ...
+
+    send_message(to="someone@elsewhere.example", subject="...", body="...")   # blocked: returns a notice
+```
+
+The policy (`~/.intentseal/policies/my-agent.yaml`) lists your agent's tools with their risk, allow-lists (recipients,
+domains, paths), pinned fields and the words that count as the user asking for an action. Any tool not listed is
+blocked in enforce mode; `mode: monitor` records everything and blocks nothing.
+
+## Remote mode (a shared gateway, Console, audit trail)
+
+```python
+guard = Guard("my-agent", remote="https://intentseal.example.com", api_key=os.environ["INTENTSEAL_KEY"])
+```
+
+Same API; decisions come from the gateway, which also offers an OpenAI- and Anthropic-compatible **LLM proxy** (protect
+an agent by changing its base URL only), a Security Console (decisions, approvals, session replay, policy) and SIEM
+export.
+
+## RAG
+
+Check files when you index them and passages when you retrieve them:
+
+```python
+r = guard.inspect_result(open(path, "rb").read(), source="rag", filename=path)
+if r.enforced.value in ("BLOCK", "ESCALATE"):
+    quarantine(path)                                               # never enters the index
+else:
+    index(r.cleaned_content)
+
+with guard.session(user_id=user.id, task=question):
+    passages = [guard.inspect(c.text, source="rag") for c in retriever.search(question)]
+```
+
+## LangChain / LangGraph
+
+```python
+tools = guard.protect_tools([search_tool, email_tool])             # inputs checked, outputs inspected
+```
+
+## Links
+
+Source, documentation, evaluation results and the gateway: https://github.com/sankalp2515/intentseal
+
+Licensed under the Apache License 2.0.

intentseal-0.1.0/intentseal.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+NOTICE
+README.md
+pyproject.toml
+intentseal/__init__.py
+intentseal/guard.py
+intentseal/langchain.py
+intentseal/remote.py
+intentseal.egg-info/PKG-INFO
+intentseal.egg-info/SOURCES.txt
+intentseal.egg-info/dependency_links.txt
+intentseal.egg-info/requires.txt
+intentseal.egg-info/top_level.txt

intentseal-0.1.0/intentseal.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

intentseal-0.1.0/intentseal.egg-info/requires.txt

@@ -0,0 +1,8 @@
+intentseal-core==0.1.0
+httpx>=0.27
+
+[embedded]
+intentseal-core[classifiers,engine,ocr]==0.1.0
+
+[langchain]
+langchain-core>=0.3

intentseal-0.1.0/intentseal.egg-info/top_level.txt

@@ -0,0 +1 @@
+intentseal

intentseal-0.1.0/pyproject.toml

@@ -0,0 +1,41 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "intentseal"
+version = "0.1.0"
+description = "IntentSeal: a prompt-injection firewall for AI agents. Inspect what your agent reads, check what it does."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+license-files = ["LICENSE", "NOTICE"]
+authors = [{ name = "Sankalp Wanjari", email = "sankalpwanjari85@gmail.com" }]
+keywords = ["prompt injection", "llm security", "ai agents", "guardrails", "firewall", "rag", "langchain"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Security",
+  "Topic :: Scientific/Engineering :: Artificial Intelligence",
+]
+# Remote mode (a shared IntentSeal gateway) needs only this. The publish workflow keeps the two versions equal.
+dependencies = ["intentseal-core==0.1.0", "httpx>=0.27"]
+
+[project.optional-dependencies]
+embedded = ["intentseal-core[engine,classifiers,ocr]==0.1.0"]   # run the engine in-process
+langchain = ["langchain-core>=0.3"]
+
+[project.urls]
+Homepage = "https://github.com/sankalp2515/intentseal"
+Source = "https://github.com/sankalp2515/intentseal"
+Documentation = "https://github.com/sankalp2515/intentseal/blob/main/docs/INTEGRATION.md"
+Issues = "https://github.com/sankalp2515/intentseal/issues"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["intentseal*"]
+exclude = ["intentseal_core*"]

intentseal-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+