securevector-sdk-crewai 1.2.1__tar.gz → 1.2.2__tar.gz

{securevector_sdk_crewai-1.2.1/src/securevector_sdk_crewai.egg-info → securevector_sdk_crewai-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: securevector-sdk-crewai
-Version: 1.2.1
+Version: 1.2.2
 Summary: SecureVector SDK for CrewAI — brings the local threat monitor's three controls (tool-call permissions, secret/data-leak detection, threat detection) to every CrewAI tool call, with tamper-evident audit logging.
 Author: SecureVector
 License: Apache-2.0

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # `crewai-*` prefix that could imply an official CrewAI integration. See README
 # "Trademarks".
 name = "securevector-sdk-crewai"
-version = "1.2.1"
+version = "1.2.2"
 description = "SecureVector SDK for CrewAI — brings the local threat monitor's three controls (tool-call permissions, secret/data-leak detection, threat detection) to every CrewAI tool call, with tamper-evident audit logging."
 readme = "README.md"
 requires-python = ">=3.10"

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/src/securevector_sdk_crewai/__init__.py

@@ -37,6 +37,7 @@ from .config import Config
 from .costs import CostTracker, install_kickoff_tracking, track_crew_usage
 from .errors import AppUnreachable, SecureVectorError, ToolBlocked
 from .wrapper import SecureCrew
+from .tool_id import candidate_tool_ids
 
 log = logging.getLogger("securevector_sdk_crewai")
 
@@ -48,6 +49,7 @@ __all__ = [
     "track_crew_usage",
     "SecureCrew",
     "Config",
+    "candidate_tool_ids",
     "SecureVectorError",
     "ToolBlocked",
     "AppUnreachable",

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/src/securevector_sdk_crewai/_version.py

@@ -4,4 +4,4 @@ The published version is stamped from pyproject.toml / the release tag by CI;
 this constant is what `securevector_sdk_crewai.__version__` reports.
 """
 
-__version__ = "1.2.1"
+__version__ = "1.2.2"

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/src/securevector_sdk_crewai/client.py

@@ -26,7 +26,7 @@ from typing import Any, Dict, List, Optional
 
 from .config import Config
 from .errors import AppUnreachable
-from .tool_id import RUNTIME_KIND
+from .tool_id import RUNTIME_KIND, candidate_tool_ids
 
 log = logging.getLogger("securevector_sdk_crewai")
 
@@ -63,11 +63,16 @@ class LocalAppClient:
     def _request(self, method: str, path: str, body: Optional[dict]) -> Any:
         url = f"{self.cfg.base_url.rstrip('/')}{path}"
         data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Content-Type": "application/json"}
+        # Forward a credential to remote, token-gated deployments (no-op for the
+        # default loopback app, which has no inbound auth).
+        if getattr(self.cfg, "api_key", ""):
+            headers["Authorization"] = f"Bearer {self.cfg.api_key}"
         req = urllib.request.Request(
             url,
             data=data,
             method=method,
-            headers={"Content-Type": "application/json"},
+            headers=headers,
         )
         timeout = max(self.cfg.timeout_ms / 1000.0, 0.1)
         with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310 (localhost)
@@ -117,15 +122,27 @@ class LocalAppClient:
                 out[str(k)] = item
         return out
 
+    @staticmethod
+    def _lookup(index: Dict[str, dict], candidates: List[str]) -> Optional[dict]:
+        """First candidate that matches (exact casing, then lowercased)."""
+        for cand in candidates:
+            hit = index.get(cand) or index.get(cand.lower())
+            if hit:
+                return hit
+        return None
+
     def _resolve(self, tool_id, essential, overrides, synced) -> Verdict:
         name = tool_id
-        low = tool_id.lower()
+        # Tier precedence dominates candidate specificity: a synced rule that
+        # matches ANY candidate beats an override that matches the raw name.
+        candidates = candidate_tool_ids(tool_id)
         emap = self._index(essential.get("tools"), "tool_id")
         omap = self._index(overrides.get("overrides"), "tool_id")
         smap = self._index(synced.get("synced"), "tool_id")
+        in_essential = self._lookup(emap, candidates) is not None
 
         # 1. Cloud-pushed synced policy wins.
-        s = smap.get(name) or smap.get(low)
+        s = self._lookup(smap, candidates)
         if s:
             effect = str(s.get("effect", "")).lower()
             action = "allow" if effect == "allow" else "block"
@@ -133,18 +150,18 @@ class LocalAppClient:
             ver = f" v{s['policy_version']}" if s.get("policy_version") is not None else ""
             return Verdict(
                 action, "synced", f"Synced policy '{policy}'{ver}: {effect}",
-                (name in emap or low in emap), name,
+                in_essential, name,
             )
         # 2. Local user override.
-        o = omap.get(name) or omap.get(low)
+        o = self._lookup(omap, candidates)
         if o:
             return Verdict(
                 o.get("action", "allow"), "overridden",
                 f"User override: {o.get('action')}",
-                (name in emap or low in emap), name,
+                in_essential, name,
             )
         # 3. Essential registry default.
-        e = emap.get(name) or emap.get(low)
+        e = self._lookup(emap, candidates)
         if e:
             return Verdict(
                 e.get("effective_action") or e.get("default_action") or "allow",

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/src/securevector_sdk_crewai/config.py

@@ -17,6 +17,11 @@ Environment variables (all optional):
     SECUREVECTOR_SDK_AGENT_ID       agent id for Cost Tracking attribution
                                     (default "<runtime>-agent")
     SECUREVECTOR_SDK_DISABLED       set truthy to no-op entirely
+    SECUREVECTOR_API_KEY            credential forwarded to the app as
+                                    Authorization: Bearer — required when the
+                                    app is a remote, token-gated deployment
+                                    (e.g. the Terraform self-host modules);
+                                    unused for the default loopback app
 
 Note: SECUREVECTOR_ENGINE_ENDPOINT (and its legacy alias
 SECUREVECTOR_SDK_APP_URL) address the *engine* — the local app or a self-host
@@ -43,6 +48,7 @@ class Config:
     analyze_mode: str = "local"      # SecureVectorClient mode used for /analyze
     agent_id: str = ""               # Cost Tracking attribution ("" → "<runtime>-agent")
     enabled: bool = True
+    api_key: str = ""                # forwarded as Authorization: Bearer to the app
 
     @classmethod
     def from_env(cls, **overrides) -> "Config":
@@ -57,6 +63,7 @@ class Config:
             analyze_mode=os.environ.get("SECUREVECTOR_SDK_ANALYZE_MODE", "local"),
             agent_id=os.environ.get("SECUREVECTOR_SDK_AGENT_ID", ""),
             enabled=not _truthy(os.environ.get("SECUREVECTOR_SDK_DISABLED", "")),
+            api_key=os.environ.get("SECUREVECTOR_API_KEY", ""),
         )
         # Explicit kwargs win over env, but only when actually provided.
         for key, value in overrides.items():

securevector_sdk_crewai-1.2.2/src/securevector_sdk_crewai/tool_id.py

@@ -0,0 +1,77 @@
+"""Canonical tool-id normalization — the ONLY framework-specific mapping.
+
+The whole SecureVector fleet keys permissions and audit on a single canonical
+``tool_id``. CrewAI surfaces a tool's name as ``BaseTool.name`` (passed here as
+the flat ``name`` argument). Normalizing it here is the one piece of
+CrewAI-specific code; every downstream step (permission resolution, analysis,
+audit) is shared engine behaviour, so a policy authored once — "allow
+web_search, block shell" — applies identically across LangChain / LangGraph /
+CrewAI.
+
+Casing is preserved: the local app matches tool ids case-insensitively, so a
+rule authored ``tool_id="Bash"`` still governs a CrewAI tool named ``bash``.
+
+MCP tools commonly surface with a sanitized flat name (``mcp_<server>_<tool>``,
+hyphens/dots collapsed to underscores). The sanitization is lossy, so a single
+function name cannot be split back into ``server``/``tool`` unambiguously.
+``candidate_tool_ids`` therefore emits every plausible ``<server>:<tool>``
+split (most-specific first) so rules authored against the cloud
+``<server>:<tool>`` form, the bare tool name, or the raw function name all
+match — identical behaviour across the sibling SDKs.
+"""
+
+from typing import Any, List, Optional
+
+# The audit/Bill-of-Tools/OCSF pipeline groups by this attribution tag.
+RUNTIME_KIND = "crewai"
+
+_MCP_PREFIX = "mcp_"
+
+
+def normalize_tool_id(serialized: Any, name: Optional[str] = None) -> str:
+    """Resolve a canonical tool id.
+
+    Accepts a flat ``name`` (CrewAI ``BaseTool.name``) and/or a ``serialized``
+    dict (``{"name": ...}`` or a dotted ``{"id": [...]}`` path) for symmetry
+    with the other SDKs. Falls back to ``"unknown"`` so a missing name never
+    crashes the agent.
+    """
+    raw: Optional[str] = None
+    if isinstance(serialized, dict):
+        raw = serialized.get("name")
+        if not raw:
+            ident = serialized.get("id")
+            if isinstance(ident, (list, tuple)) and ident:
+                raw = str(ident[-1])
+    if not raw:
+        raw = name
+    if not raw:
+        return "unknown"
+    return str(raw).strip() or "unknown"
+
+
+def candidate_tool_ids(tool_id: str) -> List[str]:
+    """Expand one tool name into every rule key it should match.
+
+    Ordered most-specific first (the caller resolves tier-first, then takes
+    the first candidate that matches within a tier):
+
+    * the raw tool name itself (``mcp_my_api_list_items`` or ``terminal``);
+    * for MCP names, every ``<server>:<tool>`` split of the sanitized
+      remainder — the cloud policy form. The split point is ambiguous after
+      sanitization, so all splits are emitted; the app also aliases the bare
+      tool suffix of each ``<server>:<tool>`` key server-side.
+    """
+    # The caller passes an already-normalized name (normalize_tool_id here
+    # takes the framework payload, not a bare string — unlike the hermes SDK).
+    tid = str(tool_id or "").strip() or "unknown"
+    candidates = [tid]
+    if tid.lower().startswith(_MCP_PREFIX):
+        rest = tid[len(_MCP_PREFIX):]
+        parts = rest.split("_")
+        for i in range(1, len(parts)):
+            server = "_".join(parts[:i])
+            tool = "_".join(parts[i:])
+            if server and tool:
+                candidates.append(f"{server}:{tool}")
+    return candidates

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2/src/securevector_sdk_crewai.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: securevector-sdk-crewai
-Version: 1.2.1
+Version: 1.2.2
 Summary: SecureVector SDK for CrewAI — brings the local threat monitor's three controls (tool-call permissions, secret/data-leak detection, threat detection) to every CrewAI tool call, with tamper-evident audit logging.
 Author: SecureVector
 License: Apache-2.0

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/src/securevector_sdk_crewai.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/securevector_sdk_crewai.egg-info/dependency_links.txt
 src/securevector_sdk_crewai.egg-info/requires.txt
 src/securevector_sdk_crewai.egg-info/top_level.txt
 tests/test_analyze.py
+tests/test_auth.py
 tests/test_costs.py
 tests/test_engine_endpoint.py
 tests/test_interceptor.py

securevector_sdk_crewai-1.2.2/tests/test_auth.py

@@ -0,0 +1,57 @@
+"""Auth-forwarding: SECUREVECTOR_API_KEY -> Authorization: Bearer.
+
+The SDK talks to the local app over loopback by default (no auth). When the app
+is a remote, token-gated deployment (e.g. the Terraform self-host modules), the
+client forwards SECUREVECTOR_API_KEY as a Bearer credential. These tests pin
+that contract without needing a running app.
+"""
+
+import urllib.request
+
+from securevector_sdk_crewai.client import LocalAppClient
+from securevector_sdk_crewai.config import Config
+
+
+class _FakeResp:
+    def __init__(self, payload=b"{}"):
+        self._payload = payload
+
+    def read(self):
+        return self._payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _capture_headers(monkeypatch):
+    captured = {}
+
+    def fake_urlopen(req, timeout=None):
+        captured.update({k.lower(): v for k, v in req.header_items()})
+        return _FakeResp()
+
+    monkeypatch.setattr(urllib.request, "urlopen", fake_urlopen)
+    return captured
+
+
+def test_api_key_forwarded_as_bearer(monkeypatch):
+    headers = _capture_headers(monkeypatch)
+    LocalAppClient(Config.from_env(api_key="svpk_explicit"))._get("/health")
+    assert headers.get("authorization") == "Bearer svpk_explicit"
+
+
+def test_api_key_read_from_env(monkeypatch):
+    monkeypatch.setenv("SECUREVECTOR_API_KEY", "svpk_fromenv")
+    headers = _capture_headers(monkeypatch)
+    LocalAppClient(Config.from_env())._get("/health")
+    assert headers.get("authorization") == "Bearer svpk_fromenv"
+
+
+def test_no_auth_header_when_unset(monkeypatch):
+    monkeypatch.delenv("SECUREVECTOR_API_KEY", raising=False)
+    headers = _capture_headers(monkeypatch)
+    LocalAppClient(Config.from_env(api_key=""))._get("/health")
+    assert "authorization" not in headers

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/tests/test_tool_id.py

@@ -1,4 +1,8 @@
-from securevector_sdk_crewai.tool_id import RUNTIME_KIND, normalize_tool_id
+from securevector_sdk_crewai.tool_id import (
+    RUNTIME_KIND,
+    candidate_tool_ids,
+    normalize_tool_id,
+)
 
 
 def test_runtime_kind_is_langchain():
@@ -25,3 +29,20 @@ def test_missing_everything_is_unknown():
     assert normalize_tool_id(None) == "unknown"
     assert normalize_tool_id({}) == "unknown"
     assert normalize_tool_id({"name": "   "}) == "unknown"
+
+
+def test_non_mcp_candidates_are_just_the_name():
+    assert candidate_tool_ids("terminal") == ["terminal"]
+
+
+def test_mcp_candidates_emit_every_server_tool_split():
+    cands = candidate_tool_ids("mcp_my_api_list_items")
+    assert cands[0] == "mcp_my_api_list_items"  # raw name is most specific
+    assert "my:api_list_items" in cands
+    assert "my_api:list_items" in cands
+    assert "my_api_list:items" in cands
+    assert len(cands) == 4
+
+
+def test_mcp_single_segment_has_no_split():
+    assert candidate_tool_ids("mcp_solo") == ["mcp_solo"]

{securevector_sdk_crewai-1.2.1 → securevector_sdk_crewai-1.2.2}/tests/test_verdict.py

@@ -54,3 +54,38 @@ def test_synced_non_allow_effect_falls_back_to_block():
     synced = {"synced": [{"tool_id": "x", "effect": "warn"}]}
     v = _client()._resolve("x", {}, {}, synced)
     assert v.action == "block"  # engine has no warn action → safer block
+
+
+# --- MCP candidate matching ---------------------------------------------- #
+# mcp_<server>_<tool> is lossy; a rule authored in the cloud <server>:<tool>
+# form must still govern the call.
+
+def test_mcp_call_matches_cloud_server_tool_rule():
+    synced = {"synced": [{"tool_id": "github:create_issue", "effect": "block", "policy_name": "corp"}]}
+    v = _client()._resolve("mcp_github_create_issue", {}, {}, synced)
+    assert v.action == "block"
+    assert v.risk == "synced"
+
+
+def test_mcp_call_matches_raw_function_name_rule():
+    overrides = {"overrides": [{"tool_id": "mcp_github_create_issue", "action": "block"}]}
+    v = _client()._resolve("mcp_github_create_issue", {}, overrides, {})
+    assert v.action == "block"
+
+
+def test_mcp_ambiguous_split_still_matches_underscored_server():
+    # server "my-api" sanitized to my_api: rule my_api:list_items must match
+    # mcp_my_api_list_items even though the split point is ambiguous.
+    synced = {"synced": [{"tool_id": "my_api:list_items", "effect": "block"}]}
+    v = _client()._resolve("mcp_my_api_list_items", {}, {}, synced)
+    assert v.action == "block"
+
+
+def test_tier_precedence_dominates_candidate_specificity():
+    # A synced rule matching a LESS specific candidate still beats an
+    # override matching the raw name.
+    overrides = {"overrides": [{"tool_id": "mcp_github_create_issue", "action": "allow"}]}
+    synced = {"synced": [{"tool_id": "github:create_issue", "effect": "block"}]}
+    v = _client()._resolve("mcp_github_create_issue", {}, overrides, synced)
+    assert v.action == "block"
+    assert v.risk == "synced"

securevector_sdk_crewai-1.2.1/src/securevector_sdk_crewai/tool_id.py

@@ -1,40 +0,0 @@
-"""Canonical tool-id normalization — the ONLY framework-specific mapping.
-
-The whole SecureVector fleet keys permissions and audit on a single canonical
-``tool_id``. CrewAI surfaces a tool's name as ``BaseTool.name`` (passed here as
-the flat ``name`` argument). Normalizing it here is the one piece of
-CrewAI-specific code; every downstream step (permission resolution, analysis,
-audit) is shared engine behaviour, so a policy authored once — "allow
-web_search, block shell" — applies identically across LangChain / LangGraph /
-CrewAI.
-
-Casing is preserved: the local app matches tool ids case-insensitively, so a
-rule authored ``tool_id="Bash"`` still governs a CrewAI tool named ``bash``.
-"""
-
-from typing import Any, Optional
-
-# The audit/Bill-of-Tools/OCSF pipeline groups by this attribution tag.
-RUNTIME_KIND = "crewai"
-
-
-def normalize_tool_id(serialized: Any, name: Optional[str] = None) -> str:
-    """Resolve a canonical tool id.
-
-    Accepts a flat ``name`` (CrewAI ``BaseTool.name``) and/or a ``serialized``
-    dict (``{"name": ...}`` or a dotted ``{"id": [...]}`` path) for symmetry
-    with the other SDKs. Falls back to ``"unknown"`` so a missing name never
-    crashes the agent.
-    """
-    raw: Optional[str] = None
-    if isinstance(serialized, dict):
-        raw = serialized.get("name")
-        if not raw:
-            ident = serialized.get("id")
-            if isinstance(ident, (list, tuple)) and ident:
-                raw = str(ident[-1])
-    if not raw:
-        raw = name
-    if not raw:
-        return "unknown"
-    return str(raw).strip() or "unknown"