Metadata-Version: 2.5
Name: ory-adk
Version: 1.8.0
Summary: Ory Agent Security for the Google Agent Development Kit (ADK) — per-tool authorization, activity logging, and identity propagation via before/after tool callbacks. Built on ory-argus.
Author: Ory
License-Expression: Apache-2.0
Keywords: adk,agent,agent-development-kit,ai,authorization,google,ory
Requires-Python: >=3.10
Requires-Dist: google-adk>=1.0
Requires-Dist: ory-argus<2,>=1
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# ory-adk

Ory Agent Security for the [Google Agent Development Kit (ADK)](https://google.github.io/adk-docs/).

Authorizes every tool call against Ory Permissions via ADK's before/after tool callbacks,
records invocation activity, and propagates user → agent → sub-agent identity — built on
[`ory-argus`](https://pypi.org/project/ory-argus/).

```bash
pip install ory-adk
```

```python
from google.adk.agents import Agent
from ory_adk import ory_before_tool_callback, ory_after_tool_callback

agent = Agent(
    name="assistant",
    model="gemini-2.5-flash",
    tools=[search, send_email],
    before_tool_callback=ory_before_tool_callback(),   # gate every tool call
    after_tool_callback=ory_after_tool_callback(),     # record completions
)
```

In **enforce** mode a denied tool is skipped — ADK returns
the denial to the model and the tool never runs. In **observe** mode (default) the tool runs
and a `permission.observe_deny` activity event is recorded. When the model delegates to a sub-agent
(`transfer_to_agent`), a sub-agent identity + agent→subagent delegation are recorded.

## MCP tools

Tools from an `McpToolset` are checked against the MCP server and tool
(`McpServer:<server>` and `McpTool:<server>:<tool>`) with the raw MCP tool name, instead of
as native tools. ADK does not expose an MCP server name, so the server is identified by:

1. the name you give the toolset in `mcp_servers`, or
2. the toolset's `tool_name_prefix` (ADK names prefixed tools `<prefix>_<tool>`).

```python
from google.adk.tools.mcp_tool import McpToolset, StreamableHTTPConnectionParams

github = McpToolset(
    connection_params=StreamableHTTPConnectionParams(url="https://api.githubcopilot.com/mcp/"),
)

agent = Agent(
    ...,
    tools=[github],
    before_tool_callback=ory_before_tool_callback(mcp_servers={github: "github"}),
)
```

Agent Security resolves the reported name to a catalog server, so it need not match the catalog
spelling exactly. The connection URL host or launched package (for stdio, such as
`npx -y @playwright/mcp`) is sent only as a hash, which lets Agent Security recognize the
server under any name. An MCP tool from an unprefixed toolset that is not in `mcp_servers` is
checked as a native tool.

Credentials come from the shared `~/.config/ory-agent-plugins/config.json`, so a login from
any Ory harness or `ory-argus login` is reused automatically. See
[docs/sdk-integrations.md](https://github.com/ory-corp/ory-agent-plugins/blob/main/docs/sdk-integrations.md).
