Metadata-Version: 2.5
Name: ory-strands
Version: 1.9.0
Summary: Ory Agent Security for AWS Strands Agents — per-tool authorization, activity logging, and identity propagation via tool-invocation hooks. Built on ory-argus.
Author: Ory
License-Expression: Apache-2.0
Keywords: agent,ai,authorization,aws,bedrock,ory,permissions,strands
Requires-Python: >=3.10
Requires-Dist: ory-argus<2,>=1
Requires-Dist: strands-agents>=1.0
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# ory-strands

Ory Agent Security for [AWS Strands Agents](https://strandsagents.com/).

Authorizes every tool call against Ory Permissions via Strands' tool-invocation hooks,
records invocation activity, and propagates user → agent identity — built on
[`ory-argus`](https://pypi.org/project/ory-argus/).

```bash
pip install ory-strands
```

```python
from strands import Agent
from ory_strands import OryHooks

agent = Agent(model=..., tools=[search, send_email], hooks=[OryHooks()])
```

`OryHooks` subscribes to `BeforeToolCallEvent` (authorize) and
`AfterToolCallEvent` (activity log). In **enforce** mode a
denied tool is **cancelled** — Strands returns the denial as an error tool result and the
tool never runs. In **observe** mode (default) the tool runs and a `permission.observe_deny`
activity event is recorded.

## MCP tools

Tools from an `MCPClient` are checked against the MCP server and tool (`McpServer:<server>`
and `McpTool:<server>:<tool>`) with the raw MCP tool name, instead of as native tools. Strands
does not expose an MCP server name, so the server is identified by:

1. the name you give the client in `mcp_servers`, or
2. the client's `prefix` (Strands names prefixed tools `<prefix>_<tool>`).

```python
from strands.tools.mcp import MCPClient

github = MCPClient(url="https://api.githubcopilot.com/mcp/")

agent = Agent(model=..., tools=[github], hooks=[OryHooks(mcp_servers={github: "github"})])
```

Agent Security resolves the reported name to a catalog server, so it need not match the catalog
spelling exactly. `MCPClient` does not keep its URL or launch command where hooks can
read them, so no server fingerprints are sent. An MCP tool from an unprefixed client that is not in `mcp_servers` is
checked as a native tool.

Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
any Ory harness or `ory-argus login` is reused automatically. See
[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).
