Metadata-Version: 2.4
Name: dmint
Version: 1.1.0
Summary: Deterministic authorization for AI-agent tool execution
License-Expression: Apache-2.0
Classifier: Development Status :: 5 - Production/Stable
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography<51,>=42
Requires-Dist: rfc8785<0.2,>=0.1.2
Provides-Extra: dev
Requires-Dist: pytest>=8.0.0; extra == "dev"
Requires-Dist: pytest-cov>=5.0.0; extra == "dev"
Requires-Dist: ruff>=0.4.0; extra == "dev"
Requires-Dist: mypy>=1.10.0; extra == "dev"
Provides-Extra: test
Requires-Dist: pytest>=8.0.0; extra == "test"
Requires-Dist: pytest-cov>=5.0.0; extra == "test"
Dynamic: license-file

# dmint

[![CI](https://github.com/dmint-app/dmint/actions/workflows/ci.yml/badge.svg)](https://github.com/dmint-app/dmint/actions/workflows/ci.yml)
[![PyPI](https://img.shields.io/pypi/v/dmint.svg)](https://pypi.org/project/dmint/)
[![Python 3.10+](https://img.shields.io/pypi/pyversions/dmint.svg)](https://pypi.org/project/dmint/)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)

Deterministic authorization engine for AI-agent tool execution.

`dmint` intercepts tool calls before execution and evaluates them against declarative policies (`ALLOW`, `DENY`, `APPROVAL_REQUIRED`). Approvals are cryptographically bound to an RFC 8785 canonical hash of the request parameters and consumed atomically in SQLite storage to prevent replay attacks.

---

## Installation

```bash
pip install dmint
```

---

## Quickstart

```python
from datetime import datetime, timezone, timedelta
from dmint import Dmint, Policy, SQLiteApprovalStore, PolicyProvenance, policy_digest
from dmint.models import TrustedContext

# 1. Define authorization policy
policy = Policy.from_mapping({
    "rules": [
        {"effect": "allow", "tool": "database", "action": "select", "resource": "*"},
        {"effect": "approval_required", "tool": "database", "action": "update", "resource": "*"},
        {"effect": "deny", "tool": "database", "action": "drop", "resource": "*"},
    ]
})

# 2. Configure persistent store and engine
store = SQLiteApprovalStore("./approvals.sqlite3", deployment_epoch="prod-v1")
provenance = PolicyProvenance("prod-v1", policy_digest(policy), datetime.now(timezone.utc))

dmint = Dmint(
    policy=policy,
    approval_store=store,
    context=TrustedContext({}),
    agent_id="agent-prod",
    approval_ttl=timedelta(minutes=15),
    policy_provenance=provenance,
)

# 3. Protect tool callables
@dmint.protected("database.select")
def read_users(query: str):
    return [{"id": 42, "name": "Alice"}]

@dmint.protected("database.update")
def update_user(user_id: int, role: str):
    return f"User {user_id} updated to {role}"

@dmint.protected("database.drop")
def drop_table(table_name: str):
    return f"Dropped {table_name}"

# ALLOW: Executes immediately
print(read_users("SELECT * FROM users"))

# APPROVAL_REQUIRED: Halts and writes pending record to SQLite
try:
    update_user(42, "admin")
except Exception as exc:
    print(f"Action paused for approval: {exc}")
```

---

## Documentation

Full documentation, architecture specifications, and security invariants are available at [docs.dmint.app](https://docs.dmint.app).

---

## Dmint Ecosystem

`dmint` is the core authorization engine used across the Dmint project:

- [`dmint-cli`](https://github.com/dmint-app/dmint-cli): Interactive CLI for policy authoring, schema validation, and dashboard management.
- [`dmint-mcp`](https://github.com/dmint-app/dmint-mcp): Out-of-process gateway for Model Context Protocol (MCP) tool servers.
- [`dmint-dashboard`](https://github.com/dmint-app/dmint-dashboard): Local web UI for reviewing and approving pending requests.
- [`dmint-skills`](https://github.com/dmint-app/dmint-skills): Agent skill definitions for policy authoring assistants.
- [`dmint-examples`](https://github.com/dmint-app/dmint-examples): Reference integrations and attack mitigation testbeds.

---

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, commit conventions, and test instructions.

---

## License

Licensed under the [Apache License, Version 2.0](LICENSE).
