Metadata-Version: 2.5
Name: ory-agent-framework
Version: 1.8.1
Summary: Ory Agent Security for the Microsoft Agent Framework — per-tool authorization, activity logging, and identity propagation via function middleware. Built on ory-argus.
Author: Ory
License-Expression: Apache-2.0
Keywords: agent,agent-framework,ai,authorization,autogen,microsoft,ory
Requires-Python: >=3.10
Requires-Dist: agent-framework<2,>=1.20
Requires-Dist: ory-argus<2,>=1
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# ory-agent-framework

Ory Agent Security for the [Microsoft Agent Framework](https://learn.microsoft.com/agent-framework/)
(the successor to AutoGen + Semantic Kernel).

Gates every function/tool call through Ory Permissions via **function middleware**, records
invocations, and propagates the user → agent identity — built on
[`ory-argus`](https://pypi.org/project/ory-argus/).

```bash
pip install ory-agent-framework
```

This release supports the stable Microsoft Agent Framework `1.x` middleware API and is tested
against `1.20` (`agent-framework>=1.20,<2`).

```python
from ory_agent_framework import ory_function_middleware

agent = chat_client.create_agent(
    instructions="…",
    tools=[search, send_email],
    # Register Ory explicitly as function middleware.
    middleware=[ory_function_middleware()],
)
```

`ory_function_middleware()` returns SDK-native function middleware. It uses the stable
zero-argument continuation and reads successful output from `context.result`. In **enforce** mode
a denied call raises `MiddlewareTermination` with the denial result and never invokes the
function. In **observe** mode (default) the function runs and a `permission.observe_deny`
activity event is recorded. Successful calls record `tool.complete`; exceptions record
`tool.fail` before being re-raised.

## MCP tools

Pass the agent's MCP tools as `mcp_tools` so the functions they generate are checked against
the MCP server and tool (`McpServer:<server>` and `McpTool:<server>:<tool>`) instead of as
native tools:

```python
from agent_framework import MCPStreamableHTTPTool

github = MCPStreamableHTTPTool(name="github", url="https://api.githubcopilot.com/mcp/")

agent = chat_client.create_agent(
    tools=[github],
    middleware=[ory_function_middleware(mcp_tools=[github])],
)
```

The server is the MCP tool's `name`; to report a different one, map it instead:
`mcp_tools={github: "github"}`. The tool is the raw remote MCP tool name, before the SDK
normalizes it and applies `tool_name_prefix`. Agent Security resolves the reported name to a
catalog server, so it need not match the catalog spelling exactly. The MCP tool's URL host or
launched package (for `MCPStdioTool`, such as `npx -y @playwright/mcp`) is sent only as a
hash, which lets Agent Security recognize the server under any name. Functions from an MCP
tool that is not in `mcp_tools` are checked as native tools.

Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.
