microsoft-agent 2.3.8__tar.gz → 2.4.0__tar.gz

{microsoft_agent-2.3.8/microsoft_agent.egg-info → microsoft_agent-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agent
-Version: 2.3.8
+Version: 2.4.0
 Summary: Governed Microsoft Graph agent and MCP server
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License-Expression: MIT
@@ -11,7 +11,7 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: scion-sdk[mcp]<0.7.0,>=0.6.3
+Requires-Dist: scion-sdk[mcp]<0.11,>=0.10.2
 Requires-Dist: azure-core>=1.41.0
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: keyring>=25.7.0
@@ -19,7 +19,7 @@ Requires-Dist: msal>=1.39.0
 Requires-Dist: msgraph-sdk>=1.64.0
 Requires-Dist: pydantic>=2.14.1
 Provides-Extra: mcp
-Requires-Dist: scion-sdk[mcp]<0.7.0,>=0.6.3; extra == "mcp"
+Requires-Dist: scion-sdk[mcp]<0.11,>=0.10.2; extra == "mcp"
 Provides-Extra: documents
 Requires-Dist: python-docx>=1.2.0; extra == "documents"
 Requires-Dist: python-pptx>=1.0.2; extra == "documents"
@@ -147,7 +147,6 @@ tokens remain in memory and are not written to plaintext files.
 | `MICROSOFT_GRAPH_SCOPES` | — |  |
 | `MICROSOFT_ENABLED_TOOL_GROUPS` | `misc,auth,meta,mail,files,calendar,notes,tasks,contacts,user,chat,teams,sites,search,groups,communications,documents,power_platform,windows,intune` | Tools are registered, but side effects remain disabled until explicitly enabled. |
 | `MICROSOFT_ALLOW_WRITES` | `false` |  |
-| `MICROSOFT_ALLOW_DESTRUCTIVE` | `false` |  |
 | `MICROSOFT_INGESTION_PSEUDONYMIZATION_KEY_REF` | — | Required only for graph projection/ingestion. Resolve from AgentConfig or a secret store; use at least 32 bytes and never reuse an identity credential. |
 | `MICROSOFT_INTEGRATIONS_CONFIG_PATH` | — | Complex Power Platform, Intune, and Windows companion allowlists. |
 | `MICROSOFT_DOCUMENT_ARTIFACT_ROOT` | — |  |
@@ -332,13 +331,13 @@ and MCP caller identity are separate boundaries and both must be configured.
 | `microsoft_tasks` | `TASKSTOOL` | Manage microsoft tasks operations. |
 | `microsoft_teams` | `TEAMSTOOL` | Manage microsoft teams operations. |
 | `microsoft_user` | `USERTOOL` | Manage microsoft user operations. |
-| `reboot_intune_device` | `INTUNETOOL` | Immediately reboot an allowlisted Intune device after destructive action acknowledgement and time-bound confirmation. |
+| `reboot_intune_device` | `INTUNETOOL` | Immediately reboot an allowlisted Intune device after time-bound confirmation. |
 | `remote_lock_intune_device` | `INTUNETOOL` | Remotely lock an allowlisted Intune device after time-bound confirmation bound to that device and action. |
 | `replace_word_placeholders_in_office` | `DOCUMENTSTOOL` | Replace a literal placeholder throughout a paired, open Word document. |
 | `run_power_automate_desktop_flow` | `POWER_PLATFORMTOOL` | Run one allowlisted Power Automate desktop flow using its fixed Dataverse connection or connection reference. |
 | `run_power_automate_flow` | `POWER_PLATFORMTOOL` | Invoke one named, allowlisted, OAuth-protected Power Automate HTTP trigger. The caller cannot supply a trigger URL. |
 | `scan_intune_device_with_defender` | `INTUNETOOL` | Request a quick or full Microsoft Defender scan on an allowlisted Intune device with time-bound confirmation. |
-| `shut_down_intune_device` | `INTUNETOOL` | Immediately shut down an allowlisted Intune device after destructive action acknowledgement and time-bound confirmation. |
+| `shut_down_intune_device` | `INTUNETOOL` | Immediately shut down an allowlisted Intune device after time-bound confirmation. |
 | `submit_windows_action` | `WINDOWS_COMPANIONTOOL` | Submit one typed allowlisted laptop action through the authenticated outbound relay. Arbitrary shell, process, and URL execution are absent. |
 | `sync_intune_device` | `INTUNETOOL` | Request an Intune sync for an allowlisted device. Time-bound confirmation evidence bound to the action and device is required. |
 | `write_word_selection_in_office` | `DOCUMENTSTOOL` | Write bounded text at the selection in a paired, open Word task pane. |
@@ -626,8 +625,8 @@ _79 action-routed tool(s) · 268 verbose 1:1 tool(s). Each is enabled unless its
 
 Every routed action passes the fail-closed tool policy. Reads are permitted by
 default; unknown actions are treated as writes. Writes require
-`MICROSOFT_ALLOW_WRITES=true`, and destructive actions also require
-`MICROSOFT_ALLOW_DESTRUCTIVE=true`.
+`MICROSOFT_ALLOW_WRITES=true`, and destructive actions also need a live
+confirmation (the gateway's approval or the `confirm` argument).
 
 ## MCP client configuration
 
@@ -675,7 +674,6 @@ default; unknown actions are treated as writes. Writes require
         "KGTOOL": "true",
         "MAILTOOL": "true",
         "METATOOL": "true",
-        "MICROSOFT_ALLOW_DESTRUCTIVE": "false",
         "MICROSOFT_ALLOW_DEVICE_CODE": "false",
         "MICROSOFT_ALLOW_WRITES": "false",
         "MICROSOFT_AUTHORITY_HOST": "https://login.microsoftonline.com",
@@ -760,7 +758,6 @@ own runtime secret boundary.
         "KGTOOL": "true",
         "MAILTOOL": "true",
         "METATOOL": "true",
-        "MICROSOFT_ALLOW_DESTRUCTIVE": "false",
         "MICROSOFT_ALLOW_DEVICE_CODE": "false",
         "MICROSOFT_ALLOW_WRITES": "false",
         "MICROSOFT_AUTHORITY_HOST": "https://login.microsoftonline.com",
@@ -844,7 +841,6 @@ docker run -i --rm \
   -e KGTOOL=true \
   -e MAILTOOL=true \
   -e METATOOL=true \
-  -e MICROSOFT_ALLOW_DESTRUCTIVE=false \
   -e MICROSOFT_ALLOW_DEVICE_CODE=false \
   -e MICROSOFT_ALLOW_WRITES=false \
   -e MICROSOFT_AUTHORITY_HOST=https://login.microsoftonline.com \

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/README.md

@@ -79,7 +79,6 @@ tokens remain in memory and are not written to plaintext files.
 | `MICROSOFT_GRAPH_SCOPES` | — |  |
 | `MICROSOFT_ENABLED_TOOL_GROUPS` | `misc,auth,meta,mail,files,calendar,notes,tasks,contacts,user,chat,teams,sites,search,groups,communications,documents,power_platform,windows,intune` | Tools are registered, but side effects remain disabled until explicitly enabled. |
 | `MICROSOFT_ALLOW_WRITES` | `false` |  |
-| `MICROSOFT_ALLOW_DESTRUCTIVE` | `false` |  |
 | `MICROSOFT_INGESTION_PSEUDONYMIZATION_KEY_REF` | — | Required only for graph projection/ingestion. Resolve from AgentConfig or a secret store; use at least 32 bytes and never reuse an identity credential. |
 | `MICROSOFT_INTEGRATIONS_CONFIG_PATH` | — | Complex Power Platform, Intune, and Windows companion allowlists. |
 | `MICROSOFT_DOCUMENT_ARTIFACT_ROOT` | — |  |
@@ -264,13 +263,13 @@ and MCP caller identity are separate boundaries and both must be configured.
 | `microsoft_tasks` | `TASKSTOOL` | Manage microsoft tasks operations. |
 | `microsoft_teams` | `TEAMSTOOL` | Manage microsoft teams operations. |
 | `microsoft_user` | `USERTOOL` | Manage microsoft user operations. |
-| `reboot_intune_device` | `INTUNETOOL` | Immediately reboot an allowlisted Intune device after destructive action acknowledgement and time-bound confirmation. |
+| `reboot_intune_device` | `INTUNETOOL` | Immediately reboot an allowlisted Intune device after time-bound confirmation. |
 | `remote_lock_intune_device` | `INTUNETOOL` | Remotely lock an allowlisted Intune device after time-bound confirmation bound to that device and action. |
 | `replace_word_placeholders_in_office` | `DOCUMENTSTOOL` | Replace a literal placeholder throughout a paired, open Word document. |
 | `run_power_automate_desktop_flow` | `POWER_PLATFORMTOOL` | Run one allowlisted Power Automate desktop flow using its fixed Dataverse connection or connection reference. |
 | `run_power_automate_flow` | `POWER_PLATFORMTOOL` | Invoke one named, allowlisted, OAuth-protected Power Automate HTTP trigger. The caller cannot supply a trigger URL. |
 | `scan_intune_device_with_defender` | `INTUNETOOL` | Request a quick or full Microsoft Defender scan on an allowlisted Intune device with time-bound confirmation. |
-| `shut_down_intune_device` | `INTUNETOOL` | Immediately shut down an allowlisted Intune device after destructive action acknowledgement and time-bound confirmation. |
+| `shut_down_intune_device` | `INTUNETOOL` | Immediately shut down an allowlisted Intune device after time-bound confirmation. |
 | `submit_windows_action` | `WINDOWS_COMPANIONTOOL` | Submit one typed allowlisted laptop action through the authenticated outbound relay. Arbitrary shell, process, and URL execution are absent. |
 | `sync_intune_device` | `INTUNETOOL` | Request an Intune sync for an allowlisted device. Time-bound confirmation evidence bound to the action and device is required. |
 | `write_word_selection_in_office` | `DOCUMENTSTOOL` | Write bounded text at the selection in a paired, open Word task pane. |
@@ -558,8 +557,8 @@ _79 action-routed tool(s) · 268 verbose 1:1 tool(s). Each is enabled unless its
 
 Every routed action passes the fail-closed tool policy. Reads are permitted by
 default; unknown actions are treated as writes. Writes require
-`MICROSOFT_ALLOW_WRITES=true`, and destructive actions also require
-`MICROSOFT_ALLOW_DESTRUCTIVE=true`.
+`MICROSOFT_ALLOW_WRITES=true`, and destructive actions also need a live
+confirmation (the gateway's approval or the `confirm` argument).
 
 ## MCP client configuration
 
@@ -607,7 +606,6 @@ default; unknown actions are treated as writes. Writes require
         "KGTOOL": "true",
         "MAILTOOL": "true",
         "METATOOL": "true",
-        "MICROSOFT_ALLOW_DESTRUCTIVE": "false",
         "MICROSOFT_ALLOW_DEVICE_CODE": "false",
         "MICROSOFT_ALLOW_WRITES": "false",
         "MICROSOFT_AUTHORITY_HOST": "https://login.microsoftonline.com",
@@ -692,7 +690,6 @@ own runtime secret boundary.
         "KGTOOL": "true",
         "MAILTOOL": "true",
         "METATOOL": "true",
-        "MICROSOFT_ALLOW_DESTRUCTIVE": "false",
         "MICROSOFT_ALLOW_DEVICE_CODE": "false",
         "MICROSOFT_ALLOW_WRITES": "false",
         "MICROSOFT_AUTHORITY_HOST": "https://login.microsoftonline.com",
@@ -776,7 +773,6 @@ docker run -i --rm \
   -e KGTOOL=true \
   -e MAILTOOL=true \
   -e METATOOL=true \
-  -e MICROSOFT_ALLOW_DESTRUCTIVE=false \
   -e MICROSOFT_ALLOW_DEVICE_CODE=false \
   -e MICROSOFT_ALLOW_WRITES=false \
   -e MICROSOFT_AUTHORITY_HOST=https://login.microsoftonline.com \

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/docs/authentication.md

@@ -103,12 +103,12 @@ server is currently allowed to invoke:
 
 ```text
 MICROSOFT_ALLOW_WRITES=false
-MICROSOFT_ALLOW_DESTRUCTIVE=false
 ```
 
-Reads work with both flags disabled. Sends, creates, edits, uploads, flow runs,
+Reads work with writes disabled. Sends, creates, edits, uploads, flow runs,
 and remote actions require writes. Deletes, wipes, retirements, immediate
-reboots, shutdowns, and other destructive tools require both flags. Intune and
+reboots, shutdowns, and other destructive tools require writes and also a live
+confirmation (the gateway's approval or the `confirm` argument). Intune and
 Windows companion actions also enforce per-device/action allowlists and
 time-bound confirmation evidence inside their service layer.
 

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/docs/integrations.md

@@ -77,7 +77,8 @@ protected.
 Intune configuration requires at least one managed-device UUID and an explicit
 action allowlist. Every mutation requires evidence bound to the device, action,
 correlation ID, idempotency key, approver, reason, and a short expiration. Reboot
-and shutdown also require destructive acknowledgement.
+and shutdown also need a live confirmation (the gateway's approval or the
+`confirm` argument).
 
 The service uses only Microsoft Graph v1.0. `rotateBitLockerKeys` is visible in
 the capability report as unsupported because Microsoft currently documents it

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/docs/office-addin.md

@@ -27,8 +27,8 @@ URLs, or an open-ended action name.
 
 1. Start the MCP server over HTTPS and set
    `MICROSOFT_OFFICE_ADDIN_ORIGINS` to the task pane's exact HTTPS origin.
-2. Enable `documents` and `MICROSOFT_ALLOW_WRITES`. Enable
-   `MICROSOFT_ALLOW_DESTRUCTIVE` only if the agent may delete slides.
+2. Enable `documents` and `MICROSOFT_ALLOW_WRITES`. Deleting a slide also needs
+   a live confirmation (the gateway's approval or the `confirm` argument).
 3. Ask the agent to call `create_office_pairing` with `Word` or `PowerPoint`
    and a recognizable window label.
 4. Paste the returned one-time secret into **Agent pairing** in that intended

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/docs/usage.md

@@ -23,8 +23,8 @@ The installed provider families cover:
 
 Every routed action crosses the fail-closed Microsoft tool policy. Read actions are
 available by default. Unknown actions are classified as writes. Non-destructive
-writes require `MICROSOFT_ALLOW_WRITES=true`; destructive actions also
-require `MICROSOFT_ALLOW_DESTRUCTIVE=true`.
+writes require `MICROSOFT_ALLOW_WRITES=true`; destructive actions also need a live
+confirmation (the gateway's approval or the `confirm` argument).
 
 `list_microsoft_ingestion_projection` returns only keyed opaque node identifiers,
 types, and relationships. Arbora validates the signed source manifest and

microsoft_agent-2.4.0/microsoft_agent/__init__.py

@@ -0,0 +1,28 @@
+"""Microsoft Agent.
+
+CONCEPT:AU-ECO.mcp.fastmcp-middleware
+"""
+
+from scion_sdk.connector import Connector
+from scion_sdk.connector_hooks import RegistrationContext
+
+from microsoft_agent._version import __version__
+from microsoft_agent.api_client import MicrosoftGraphApi
+from microsoft_agent.auth import get_client_dependency
+
+
+def _register_extras(context: RegistrationContext) -> None:
+    """Register the non-Graph tools and the side-effect policy through the SDK hook."""
+    from microsoft_agent.mcp_server import register_extra_surface
+
+    register_extra_surface(context.server)
+
+
+connector = Connector(
+    instructions="microsoft-agent MCP Server: one typed tool per Microsoft Graph operation.",
+    api=MicrosoftGraphApi,
+    get_client=get_client_dependency,
+    extra_registrations=(_register_extras,),
+)
+
+__all__ = ["__version__", "connector"]

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/api/api_client_admin.py

@@ -1,5 +1,7 @@
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from microsoft_agent.api._graph_models import (
     graph_model_from_dict,
 )
@@ -137,6 +139,7 @@ class MicrosoftGraphApiAdmin(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def update_organization(
         self, org_id: str, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -555,6 +558,7 @@ class MicrosoftGraphApiAdmin(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def create_conditional_access_policy(
         self, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -582,6 +586,7 @@ class MicrosoftGraphApiAdmin(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def update_conditional_access_policy(
         self, policy_id: str, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -919,6 +924,7 @@ class MicrosoftGraphApiAdmin(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def create_role_assignment(
         self, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/api/api_client_base.py

@@ -8,7 +8,7 @@ from kiota_authentication_azure.azure_identity_authentication_provider import (
 from msgraph import GraphServiceClient
 from msgraph.graph_request_adapter import GraphRequestAdapter
 from scion_sdk.exceptions import AuthError
-from scion_sdk.http.client import create_async_http_client
+from scion_sdk.http.client import build_http_client
 from scion_sdk.http.options import HttpClientOptions
 from scion_sdk.http.retry import RetryPolicy
 from scion_sdk.tls.profile import ResolvedTLSProfile
@@ -44,7 +44,7 @@ class MicrosoftGraphApiBase(ABC):
                 scopes=auth_manager.scopes,
                 allowed_hosts=[endpoint_host],
             )
-            self._http_client = create_async_http_client(
+            self._http_client = build_http_client(
                 HttpClientOptions(
                     base_url=auth_manager.graph_base_url,
                     timeout=httpx.Timeout(30.0),
@@ -55,7 +55,8 @@ class MicrosoftGraphApiBase(ABC):
                         max_keepalive_connections=16,
                     ),
                     pin_egress=True,
-                )
+                ),
+                async_=True,
             )
         except Exception:
             self.tls_profile.cleanup()

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/api/api_client_directory.py

@@ -1,6 +1,7 @@
 from typing import Any
 
 from msgraph.generated.users.users_request_builder import UsersRequestBuilder
+from scion_sdk.mcp.destructive import destructive_operation
 
 from microsoft_agent.api._graph_models import (
     graph_model_from_dict,
@@ -639,6 +640,7 @@ class MicrosoftGraphApiDirectory(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def dismiss_risky_user(
         self, user_id: str, params: dict | None = None
     ) -> dict[str, Any]:

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/api/api_client_drive.py

@@ -1,5 +1,7 @@
 from typing import Any
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from microsoft_agent.api._graph_models import (
     comma_separated_values,
     graph_model_from_dict,
@@ -581,6 +583,7 @@ class MicrosoftGraphApiDrive(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def update_admin_sharepoint(
         self, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/api/api_client_other.py

@@ -5,6 +5,8 @@ from typing import TYPE_CHECKING, Any
 if TYPE_CHECKING:
     from microsoft_agent.power_platform import AsyncHttpTransport
 
+from scion_sdk.mcp.destructive import destructive_operation
+
 from microsoft_agent.api._graph_models import (
     decode_graph_base64,
     graph_model_from_dict,
@@ -482,6 +484,7 @@ class MicrosoftGraphApiOther(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def create_application(
         self, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -553,6 +556,7 @@ class MicrosoftGraphApiOther(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def add_application_password(
         self, app_id: str, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -657,6 +661,7 @@ class MicrosoftGraphApiOther(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def create_service_principal(
         self, data: dict[str, Any], params: dict | None = None
     ) -> dict[str, Any]:
@@ -1069,6 +1074,7 @@ class MicrosoftGraphApiOther(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def wipe_managed_device(
         self, device_id: str, params: dict | None = None
     ) -> dict[str, Any]:
@@ -1094,6 +1100,7 @@ class MicrosoftGraphApiOther(MicrosoftGraphApiBase):
             print(f"Operation failed: {type(e).__name__}")
             return {"error": "Operation failed"}
 
+    @destructive_operation
     async def retire_managed_device(
         self, device_id: str, params: dict | None = None
     ) -> dict[str, Any]:

{microsoft_agent-2.3.8 → microsoft_agent-2.4.0}/microsoft_agent/config_cli.py

@@ -39,7 +39,6 @@ def configuration_report() -> dict[str, Any]:
         },
         "policy": {
             "writes_enabled": settings.allow_write_tools,
-            "destructive_enabled": settings.allow_destructive_tools,
             "enabled_tool_groups": list(settings.enabled_tool_groups),
         },
         "documents": get_document_capabilities().model_dump(mode="json"),