An action firewall for MCP – OAuth says who, not whether the call should run

AgenticDome released agenticdome-python-sdk, an official Python SDK and middleware package that enforces deterministic security controls—prompt ingress, tool execution, agent-to-agent handoffs, and output egress—across fifteen AI runtimes including CrewAI, LangGraph, and Microsoft AutoGen. The SDK supports local simulation mode without an account or network connection, and integrates with MCP hosts via a dedicated Action Firewall guide. The package is available on PyPI and includes framework integration guides and a production playbook.

Source and examples https://github.com/agenticdome/agenticdome-python-sdk · Framework integration guides https://github.com/agenticdome/agenticdome-python-sdk/tree/main/docs/frameworks · MCP integration guide https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/mcp-integration.md · Issue tracker https://github.com/agenticdome/agenticdome-python-sdk/issues · Security policy https://github.com/agenticdome/agenticdome-python-sdk/blob/main/SECURITY.md · PyPI package https://pypi.org/project/agenticdome-python-sdk/ Production-grade security guardrails, DLP, tool authorization, and cryptographically verified multi-agent delegation for Python autonomous AI runtimes. agenticdome-python-sdk is the official Python SDK and middleware package for AgenticDome https://agenticdome.io . It enforces deterministic security controls at every boundary your agents cross — prompt ingress, tool execution, agent-to-agent handoffs, and output egress — using the tenant's assigned AgenticDome runtime sidecar. One security pattern, fifteen runtimes: CrewAI · PydanticAI · LangGraph/LangChain · Microsoft Agent Framework · Microsoft AutoGen · Microsoft AI Foundry · OpenAI Agents SDK · Claude Agent SDK · Hugging Face smolagents · Agno · Google ADK · LlamaIndex · AWS Bedrock · MCP hosts/gateways · custom Python. pip install agenticdome-python-sdk export AGENTICDOME MODE=local sim No account, API key, tenant, network connection, or third-party framework package is required. agenticdome-demo --framework langgraph --scenario both Look for ALLOWED — TOOL WOULD EXECUTE followed by BLOCKED — TOOL WOULD NOT EXECUTE . Offline demonstration—not runtime evidence.This command evaluates two fixed onboarding scenarios with a deterministic, bundled public baseline. It does not contact AgenticDome, load tenant policy, execute either tool, or instantiate a LangGraph graph. --framework langgraph labels the example payload and points you to the matching integration; it is not a LangGraph integration test. agenticdome-demo --list-frameworks agenticdome-demo --framework all --scenario both You can also open the framework example gallery /agenticdome/agenticdome-python-sdk/blob/main/examples/README.md and run the individual example matching your stack. Before editing production code, choose the dedicated framework integration guide /agenticdome/agenticdome-python-sdk/blob/main/docs/frameworks/README.md , then use the production integration playbook /agenticdome/agenticdome-python-sdk/blob/main/examples/PRODUCTION INTEGRATION.md for the cross-framework attachment and proof checklist. MCP host and gateway developers can follow the dedicated MCP Action Firewall guide https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/mcp-integration.md . When you are ready to test real tenant policy, remove AGENTICDOME MODE=local sim , obtain the assigned runtime sidecar URL, Runtime/SDK API key and tenant ID from AgenticDome, and configure: unset AGENTICDOME MODE export AGENTICDOME API BASE="https://your-assigned-sidecar.example" export AGENTICDOME API KEY="your runtime sdk key" export AGENTICDOME TENANT ID="your tenant id" agenticdome-demo --framework langgraph --scenario both --live With --live , the same fixed scenarios are sent to the actual assigned AgenticDome runtime sidecar, so their verdicts come from the customer's tenant policy and engine. The live demo still does not instantiate LangGraph or prove that an application has attached the framework adapter at every execution boundary. Use the framework guide to attach the adapter, test the real application path, and use AgenticDome Runtime Assurance for production evidence. The 30-second version: block a prompt-injected refund before it executes. import agenticdome sdk.crewai registers global CrewAI security hooks crew = Crew agents= manager, specialist , tasks= task result = crew.kickoff hostile prompts, unsafe tools, and rogue delegations are now BLOCKED before execution Five-minute developer trial five-minute-developer-trial Why AgenticDome why-agenticdome How It Works how-it-works Quickstart quickstart Installation installation Configuration configuration Choosing Your Integration Point choosing-your-integration-point — dedicated framework guides /agenticdome/agenticdome-python-sdk/blob/main/docs/frameworks/README.md Framework Integrations framework-integrations Core SDK Client Custom Runtimes core-sdk-client-custom-runtimes Production Deployment production-deployment Source Installation and Verification source-installation-and-verification Licensing licensing An agent can be hijacked while holding valid tokens, approved tools, and fully authorized paths. Legacy security sees a compliant request; the business sees a breach. AgenticDome adds an intent-aware enforcement layer at the exact boundaries where agents act: Give every agent and workload a distinct principal and keep your identity provider authoritative for authentication, scopes, conditional access, credential lifecycle, and downstream entitlements. Then pass the identity the application has actually authenticated into AgenticDome alongside the agent, purpose, tool, final arguments, session, and delegation context. A valid token proves access authority; it does not prove that a prompt-influenced action is appropriate. AgenticDome complements IAM by evaluating that action at the application-controlled execution boundary. It does not issue enterprise identities or make a stolen credential safe. For the architectural rationale, see An agent principal proves who—not why https://www.agenticdome.io/research/agent-principal-identity . | Control | What it stops | Where it runs | |---|---|---| Prompt ingress guardrails | Prompt injection, jailbreaks, system-prompt extraction, instruction override, policy bypass | Before agent/LLM execution | Tool & skill authorization | Unauthorized or out-of-policy tool calls, evaluated on agent identity, tool name, arguments, session, source metadata, and delegation chain | Before tool execution | Cryptographic delegation handoffs | Confused-deputy attacks, lateral privilege escalation, stolen-token replay between agents | At every manager→specialist handoff | Inline output DLP | Leakage of PII, emails, phone numbers, API keys, access tokens, cloud credentials, corporate secrets, compliance-sensitive records | Before output is persisted, displayed, or re-enters the agent loop | Fail-safe runtime behavior | Silent security bypass when the assigned runtime is unavailable | Configurable fail-closed production / fail-open dev | Delegation tokens are the differentiator. Every authorized handoff issues a decision token that binds the originating human subject when present , the ordered and nested agent actor chain, source manager and target specialist, exact tool name and arguments, session ID, trace and lineage root/parent IDs, intent digest, policy binding, authorized scopes, trust epochs, tenant context, and the policy decision itself. Execution verification consumes the server-side call budget and checks revocation state — a token authorizes one exact action, once. Optional proof-of-possession hardens this further: a DPoP-style signed JWT is tied to the decision-token hash, so sending a public-key thumbprint alone is never treated as proof. pip install "agenticdome-python-sdk pop " python from agenticdome sdk import create dpop proof, generate rsa proof key proof key = generate rsa proof key Pass proof key "thumbprint" as proof thumbprint when authorizing. proof = create dpop proof proof key "private key pem" , access token=decision token, method="POST", uri="/a2a", client.a2a verify decision token rpc decision token, tool name=tool name, tool args=tool args, agent id=worker id, source agent id=manager id, proof token=proof, AgenticDome uses a hybrid split-plane architecture . Your application executes agents, tools and workflows. The SDK protects the application-controlled boundaries and sends live policy checks to the tenant's assigned runtime sidecar. The management console distributes configuration to that runtime out of band; it is not the per-action SDK endpoint. Management console / control plane | | policy and tenant configuration out of band v Tenant-assigned runtime sidecar <------ live policy checks ------+ | | +---------------- verdict / authorization -------------- | | Customer application | user input - agent - tool / MCP - agent - output | ^ ^ ^ | +---------+--------------------+------------------+ AgenticDome SDK protection boundaries The SDK must be attached in application code; setting environment variables alone does not intercept a framework. The assigned sidecar authenticates the tenant and evaluates live requests. Tools still execute in the customer's environment or selected provider unless a separate execution service has been deliberately configured. Managed service: AgenticDome assigns the tenant a managed sidecar in the selected supported geographic region, subject to availability and the customer's plan or contract. Sovereign deployment: the runtime is deployed within the contracted customer-controlled boundary, such as a dedicated VPC, customer cloud, or on-premises environment. The SDK does not choose or change runtime placement; it connects to the tenant-specific API base supplied during onboarding. See Runtime location and Redis responsibilities https://github.com/agenticdome/agenticdome-python-sdk/blob/main/docs/runtime-deployment.md for the deployment boundary and customer responsibilities. | Persona / component | Responsibilities | Commercial model | |---|---|---| Enterprise / organization | Hosts the local agent runtime. Uses the AgenticDome console to create policies, obtain a Tenant ID, generate API keys, and monitor security events. | Paid subscriber SaaS license or API volume | Agent / tool developer | Builds tools, skills, agents, and workflow components. Uses the SDK to support secure tool calls, delegation metadata, and DLP-aware outputs. | Free ecosystem partner — no subscription required | This Python SDK | Runs inside the application process. Protects supported framework boundaries, calls the assigned runtime sidecar, and enforces returned policy results. | Runtime security utility | Assigned runtime sidecar | Authenticates the tenant and evaluates live guardrail, tool, delegation and output requests using distributed policy. | Runtime enforcement service | Management console / control plane | Manages tenant configuration, policy distribution, governance workflows and evidence. It is not the SDK's per-action API URL. | Management plane | Start with a network-free simulation, then connect the same SDK to your assigned runtime sidecar for real tenant enforcement. 1. Try the installed local simulation. No account, API key, tenant, network call, telemetry, or framework package is required: pip install agenticdome-python-sdk Label the fixed demonstration as LangGraph and show one ALLOWED and one BLOCKED path. agenticdome-demo --framework langgraph --scenario both Or repeat the fixed demonstration under every supported framework label. agenticdome-demo --framework all --scenario both agenticdome-demo --list-frameworks This is visibly labelled LOCAL SIMULATION — NOT CLOUD ENFORCEMENT . It evaluates two fixed inputs with a small deterministic bundled baseline through the public core-client response shape. The --framework option changes the payload label and integration guidance; it does not import, instantiate, or run the selected framework. The simulation does not load tenant policy, issue signed decision tokens or execution receipts, write cloud evidence, or provide runtime assurance. To exercise a real adapter inside your own process without credentials, set AGENTICDOME MODE=local sim in that application or framework example. The SDK refuses that mode when AGENTICDOME PRODUCTION MODE=true . Browse the public examples/ /agenticdome/agenticdome-python-sdk/blob/main/examples/README.md gallery for a runnable allowed/blocked example for CrewAI, PydanticAI, LangGraph, Microsoft Agent Framework, AutoGen, AI Foundry, OpenAI Agents, Claude, smolagents, Agno, Google ADK, LlamaIndex, Bedrock, MCP, and custom Python. Local blocked/redacted results emit safe terminal logs containing verdict metadata only—not raw prompts, arguments, keys, or secrets. 2. Onboard for real enforcement. Create an account in the AgenticDome Management Console, obtain your tenant identifier and Runtime / SDK API key, and identify the tenant's assigned runtime sidecar. 3. Install the SDK with the extra matching your framework: pip install "agenticdome-python-sdk crewai " or pydanticai, langgraph, ... 4. Configure the three required production environment variables live clients fail with a configuration error rather than silently running unprotected : Tenant runtime sidecar URL. Do not use the control-plane website URL here. export AGENTICDOME API BASE="https://demo-sidecar.agenticdome.io" export AGENTICDOME API KEY="your api key abc123..." export AGENTICDOME TENANT ID="your tenant id xyz789..." 5. Attach AgenticDome at your framework's boundary — environment variables alone never intercept execution; every framework needs its one-time code attachment see Choosing Your Integration Point choosing-your-integration-point : python CrewAI example: one import in your bootstrap, before crews are built. import agenticdome sdk.crewai from crewai import Crew crew = Crew agents= manager, specialist , tasks= task result = crew.kickoff 6. Verify locally or against the real assigned sidecar: Local, deterministic and network-free. agenticdome-demo --framework crewai --scenario both agenticdome-demo --framework langgraph --scenario both agenticdome-demo --framework claude --scenario both agenticdome-demo --framework smolagents --scenario both agenticdome-demo --framework all --scenario both Additional blocked-only examples for focused attack demonstrations. agenticdome-demo --framework claude --scenario metadata exfil agenticdome-demo --framework smolagents --scenario metadata exfil Live: uses AGENTICDOME API BASE/API KEY/TENANT ID and the assigned sidecar. agenticdome-demo --framework langgraph --scenario safe lookup --live Every Python integration listed below is selectable through agenticdome-demo --framework ... ; the demo prints the correct package extra and integration import for that framework. Local simulation proves SDK compatibility and control flow only. The live command proves the configured tenant-sidecar path. Install the core SDK alone for custom runtimes, or add the extra for your framework: pip install agenticdome-python-sdk | Target runtime | Command | |---|---| | CrewAI | pip install "agenticdome-python-sdk crewai " | | PydanticAI | pip install "agenticdome-python-sdk pydanticai " | | LangGraph / LangChain | pip install "agenticdome-python-sdk langgraph " | | Microsoft Agent Framework | pip install "agenticdome-python-sdk microsoft " | | Microsoft AutoGen AgentChat / Core Python 3.10+ | pip install "agenticdome-python-sdk autogen " | | Microsoft AI Foundry | pip install "agenticdome-python-sdk foundry " | | OpenAI Agents SDK | pip install "agenticdome-python-sdk openai-agents " | | Anthropic Claude Agent SDK | pip install "agenticdome-python-sdk claude " | | Hugging Face smolagents | pip install "agenticdome-python-sdk smolagents " | | Agno | pip install "agenticdome-python-sdk agno " | | Google ADK | pip install "agenticdome-python-sdk google-adk " | | LlamaIndex | pip install "agenticdome-python-sdk llamaindex " | | AWS Bedrock / Bedrock Agents | pip install "agenticdome-python-sdk bedrock " | | MCP host / gateway | pip install "agenticdome-python-sdk mcp " | | Optional cross-process delegation store | pip install "agenticdome-python-sdk redis " | | Proof-of-possession helpers | pip install "agenticdome-python-sdk pop " | | All optional integrations | pip install "agenticdome-python-sdk all " | Some adapters are dependency-light at import time: Google ADK, LlamaIndex, Bedrock, MCP, and Microsoft helpers can wrap local boundaries without forcing one exact runtime stack. Install the framework packages your application actually uses. AgenticDome supports framework versions inside the dependency ranges declared by the published package. Check the package metadata and compatibility table before upgrading an integration, especially for multi-package stacks such as LangGraph/LangChain. This means upgrading support for the latest framework does not silently drop customers on the previously certified version. Versions below the displayed certified floor are not claimed as supported until they are tested. Customers managing framework dependencies themselves may install the core SDK without an extra, but their framework version must still be inside the certified range for a production support claim. AgenticDome has two setup layers, and both are required: Configuration layer — environment variables that every framework reads at runtime. Global to the process, container, worker, or serverless function. Code integration layer — the framework boundary where AgenticDome is attached, imported, or wrapped next section . Environment variables do not intercept framework execution by themselves. Every supported Python integration inherits the same credential-free, network-free simulator: export AGENTICDOME MODE="local sim" No API base, API key, tenant ID, or third-party framework package is needed to run the public demonstration. ALLOWED decisions are logged at INFO ; BLOCKED and REDACTED decisions are logged at WARNING so they are visible in a normal terminal. Logs contain decision metadata only and exclude raw prompt text and tool arguments. Local simulation is deliberately limited: it uses the bundled public baseline, does not execute tools, does not use tenant policy, topology, signed provenance, runtime telemetry, decision tokens, or execution receipts, and cannot satisfy an enforced execution broker. It is refused whenever AGENTICDOME PRODUCTION MODE=true . export AGENTICDOME API BASE="https://demo-sidecar.agenticdome.io" tenant runtime sidecar, not the console URL export AGENTICDOME API KEY="your api key abc123..." export AGENTICDOME TENANT ID="your tenant id xyz789..." export AGENTICDOME FAIL CLOSED="true" export AGENTICDOME REDACT PII="true" export AGENTICDOME REDACT SECRETS="true" export AGENTICDOME BLOCK ON SENSITIVE OUTPUT="false" export AGENTICDOME REQUIRE TOKEN="true" export AGENTICDOME REPORT INCIDENTS="true" Redis is not required for normal SDK policy calls or when using an assigned managed sidecar. Add customer-managed Redis only when manager-to-specialist delegation is authorised in one application process, worker, or pod and its one-time handoff state must be consumed in another: export AGENTICDOME REDIS URL="redis://redis.internal:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:production:handoff" | Runtime style | Put AgenticDome config here | |---|---| | Local development | Shell exports, .env , direnv, or your IDE run configuration | | Docker / Compose | environment: entries, env file: , or secret-mounted environment variables | | Kubernetes | Secret / ConfigMap values injected into the deployment or job | | CI/CD workers | Pipeline secret variables | | Celery / RQ / background workers | Worker process environment — not only the web process | | Serverless | Function environment variables or secret manager bindings | export AGENTICDOME PLATFORM="crewai" runtime platform label used in policy context export AGENTICDOME REQUIRE SESSION ID="false" require explicit session IDs vs fallback local IDs export AGENTICDOME DEFAULT TOOL PLATFORM="unknown" fallback platform for tools export AGENTICDOME HANDOFF TOKEN TTL S="900" delegation token lifetime in seconds export AGENTICDOME BLOCKED INCIDENT SEVERITY="medium" default severity for incident reports export AGENTICDOME PRODUCTION MODE="false" production hardening stable session ID enforcement Full configuration reference — core variables | Environment Variable | Type | Default | Description | |---|---|---|---| AGENTICDOME API BASE | string | required | Tenant runtime sidecar origin, e.g. https://demo-sidecar.agenticdome.io . Separate from the control-plane console URL. | AGENTICDOME API KEY | string | required | API key generated in the AgenticDome console. | AGENTICDOME TENANT ID | string | required | Tenant or organization isolation namespace. | AGENTICDOME MODE | live / local sim | live | Selects real sidecar enforcement or the credential-free, network-free demonstration evaluator. local sim is refused in production mode. | AGENTICDOME PLATFORM | string | framework-specific | Runtime platform label included in policy context. | AGENTICDOME TIMEOUT S | integer | 20 | HTTP timeout in seconds for SDK calls. | AGENTICDOME FAIL CLOSED | boolean | true | Blocks execution if security checks fail. | AGENTICDOME REDACT PII | boolean | true | Enables PII redaction for output review. | AGENTICDOME REDACT SECRETS | boolean | true | Enables secret and credential redaction. | AGENTICDOME BLOCK ON SENSITIVE OUTPUT | boolean | false | Blocks entire output when sensitive content is detected. | AGENTICDOME REQUIRE TOKEN | boolean | true | Requires delegated specialist executions to include a token. | AGENTICDOME REQUIRE SESSION ID | boolean | framework-specific | Requires explicit session ID for strict audit mapping. | AGENTICDOME DEFAULT TOOL PLATFORM | string | unknown / python | Fallback platform for tools. | AGENTICDOME HANDOFF TOKEN TTL S | integer | 900 | Delegation token TTL in seconds. | AGENTICDOME REDIS URL | string | empty | Optional customer-application Redis URL, needed only when one-time delegation state must cross processes, workers, or pods. It is unrelated to the managed sidecar's internal backing services. | AGENTICDOME REDIS KEY PREFIX | string | framework-specific | Optional key prefix for the customer application's cross-process delegation store. | AGENTICDOME TOKEN HMAC SECRET | string | empty | Optional secret-manager value used by the SDK to protect shared delegation state. Applications should not inspect or construct that state. | AGENTICDOME PRODUCTION MODE | boolean | false | Enables production hardening such as stable session ID enforcement. | AGENTICDOME REQUIRE STABLE SESSION ID IN PROD | boolean | true | Requires a stable session/run/trace ID when production mode is enabled. | AGENTICDOME CLOUD PROVIDER | string | empty | Optional cloud/provider label added to policy context. | AGENTICDOME CLOUD PROJECT ID | string | empty | Optional project/account label added to policy context. | AGENTICDOME IDENTITY PROVIDER | string | empty | Optional identity-provider label added to policy context. | AGENTICDOME ENABLE COPILOT THREAT API | boolean | false | Enables optional Microsoft Copilot / AI Foundry threat helper calls where available. | AGENTICDOME ENFORCE COPILOT THREAT API | boolean | false | Makes optional Copilot / AI Foundry threat helper failures or blocks enforce locally. | AGENTICDOME COPILOT API VERSION | string | 2025-09-01 | API version used by optional Copilot / AI Foundry threat helper calls. | AGENTICDOME BEARER TOKEN | string | optional | Bearer token used by Microsoft AI Foundry threat-contract endpoints. | AGENTICDOME REPORT INCIDENTS | boolean | true | Reports blocked actions and middleware failures. | AGENTICDOME BLOCKED INCIDENT SEVERITY | string | medium | Default severity for incident reports. | Full configuration reference — per-adapter variables Every framework adapter exposes the same family of local hardening controls, prefixed per adapter: AGENTICDOME CREWAI , AGENTICDOME PYDANTICAI , AGENTICDOME LANGGRAPH , AGENTICDOME MSAF Microsoft Agent Framework , AGENTICDOME AUTOGEN , AGENTICDOME FOUNDRY , AGENTICDOME OPENAI AGENTS , AGENTICDOME CLAUDE , AGENTICDOME SMOLAGENTS , AGENTICDOME AGNO , AGENTICDOME BEDROCK , AGENTICDOME GOOGLE ADK , and AGENTICDOME MCP . Common per-adapter pattern substitute the prefix for your adapter : | Variable suffix | Type | Default | Description | |---|---|---|---| MAX INPUT CHARS | integer | 50000 | Maximum prompt/input text reviewed before local truncation or blocking. | MAX OUTPUT CHARS | integer | 100000 | Maximum output text reviewed before local truncation or blocking. | MAX TOOL ARG CHARS | integer | 20000 | Maximum serialized tool arguments before blocking. | STREAMING BUFFER CHARS | integer | 4000 | Sliding buffer used by streaming sanitization helpers CrewAI, Agno, OpenAI Agents, Bedrock, Google ADK, LangGraph . | RATE LIMIT PER MINUTE | integer | 0 | Per-agent/session/purpose local rate limit; 0 disables it. | RETRY ATTEMPTS | integer | 2 | Retry attempts for policy client calls. | RETRY BACKOFF S | float | 0.25 | Initial exponential backoff delay for policy client retries. | CIRCUIT BREAKER FAILURES | integer | 5 | Consecutive policy call failures before opening the local circuit breaker. | CIRCUIT BREAKER RESET S | integer | 60 | Seconds before retrying after the circuit breaker opens. | AUDIT LOGGING | boolean | true | Emits structured audit logs from the adapter. | OTEL ENABLED | boolean | true | Emits OpenTelemetry span events when OpenTelemetry is installed and a span is active. | EMERGENCY BLOCK TOOLS | CSV string | empty | Local emergency deny list for tool names. | EMERGENCY BLOCK AGENTS | CSV string | empty | Local emergency deny list for agent IDs. | Adapter-specific additions: | Environment Variable | Type | Default | Description | |---|---|---|---| AGENTICDOME LANGGRAPH AGENT ID | string | langgraph orchestrator | Default LangGraph orchestrator node identity. | AGENTICDOME LANGGRAPH FINAL ID | string | langgraph final node | Default LangGraph final-output node identity. | AGENTICDOME LANGGRAPH REQUIRE SERVER TOKENS | boolean | false | Requires handoff authorization responses to include server-issued decision tokens. | AGENTICDOME CLAUDE AGENT ID | string | claude agent | Default Claude Agent SDK identity. | AGENTICDOME CLAUDE STRICT DELEGATED EXECUTION | boolean | true | Requires server-issued decision tokens for Claude multi-agent handoffs. | AGENTICDOME SMOLAGENTS AGENT ID | string | smolagent | Default smolagents identity. | AGENTICDOME SMOLAGENTS SCAN CODE EXPRESSIONS | boolean | true | Reviews CodeAgent-generated Python immediately before executor invocation. | AGENTICDOME SMOLAGENTS STRICT DELEGATED EXECUTION | boolean | true | Authorizes and verifies managed-agent handoffs using bound decision tokens. | AGENTICDOME LANGGRAPH STRICT DELEGATED EXECUTION | boolean | true | Blocks delegated executions that carry delegation metadata without a valid token. | AGENTICDOME FOUNDRY REQUIRE OUTPUT SANITIZATION IN PROD | boolean | true | Requires API-key-backed Mesh output sanitization when Foundry production mode is enabled. | AGENTICDOME BEDROCK AGENT ID | string | aws bedrock agent | Default agent identity for Bedrock runtime calls and local action handlers. | AGENTICDOME BEDROCK MODEL ID | string | empty | Optional default Bedrock model ID for policy context. | AGENTICDOME AWS ACCOUNT ID | string | empty | AWS account ID added to Bedrock policy context when available. | AGENTICDOME AWS REGION | string | AWS REGION / AWS DEFAULT REGION | AWS region added to Bedrock policy context when available. | AGENTICDOME AWS ROLE ARN | string | empty | AWS role ARN added to Bedrock policy context. | AGENTICDOME AWS PRINCIPAL ARN | string | empty | AWS principal/caller ARN added to Bedrock policy context. | AGENTICDOME SANITIZE MODEL OUTPUT | boolean | true | Enables Mesh output review for model responses before returning to the application. | AGENTICDOME GOOGLE ADK AGENT ID | string | google adk agent | Default agent identity for Google ADK callback enforcement. | AGENTICDOME LLAMAINDEX AGENT ID | string | llamaindex agent | Default agent identity for LlamaIndex tools, query engines, and retrievers. | AGENTICDOME SANITIZE QUERY OUTPUT | boolean | true | Enables Mesh output review for LlamaIndex query responses. | AGENTICDOME MCP HOST ID | string | MCP Enterprise Host | Default agent identity for the MCP host or gateway process. | AGENTICDOME MCP TOOL PLATFORM | string | mcp third party server | Default downstream MCP server platform label for policy and billing context. | AGENTICDOME SANITIZE TOOL OUTPUT | boolean | true | Enables Mesh output review for tool results before returning to the client. | AGENTICDOME SANITIZE RESOURCE OUTPUT | boolean | true | Enables Mesh output review for MCP resource read results. | AGENTICDOME SANITIZE PROMPT OUTPUT | boolean | true | Enables Mesh output review for MCP prompt results. | AGENTICDOME SANITIZE STREAMING OUTPUT | boolean | true | Enables chunk-level sanitization helpers for streaming MCP responses. | AGENTICDOME VERIFY DECISION TOKENS | boolean | true | Verifies delegated decision tokens when MCP tool calls carry handoff metadata. | AGENTICDOME SCREEN UPSTREAM PROMPT | boolean | true | Screens upstream user prompt text in MCP host context before tool forwarding. | AGENTICDOME MCP PROTECT TOOLS LIST | boolean | true | Authorizes and filters MCP tools/list discovery responses. | AGENTICDOME MCP PROTECT RESOURCES LIST | boolean | true | Authorizes MCP resources/list discovery requests. | AGENTICDOME MCP PROTECT RESOURCES READ | boolean | true | Authorizes MCP resources/read requests before forwarding. | AGENTICDOME MCP PROTECT PROMPTS LIST | boolean | true | Authorizes MCP prompts/list discovery requests. | AGENTICDOME MCP PROTECT PROMPTS GET | boolean | true | Authorizes MCP prompts/get requests before forwarding. | AGENTICDOME MCP PROTECT SAMPLING CREATE MESSAGE | boolean | true | Authorizes MCP sampling/createMessage requests. | AGENTICDOME MCP SERVER ID | string | empty | Default MCP server identity included in policy context. | AGENTICDOME MCP SERVER URL | string | empty | Default MCP server URL included in policy context. | AGENTICDOME MCP SERVER TRUST LEVEL | string | empty | Default MCP server trust label included in policy context. | AGENTICDOME MCP SERVER VENDOR | string | empty | Default MCP server vendor included in policy context. | AGENTICDOME MCP MAX REQUEST TEXT CHARS | integer | 20000 | Maximum upstream request text sent for prompt/method authorization before local truncation. | One table, one decision. Find your runtime, apply the required code action, and jump to its guide. In every case, environment config alone is not enough — hooks activate only after the code attachment shown here. For a shorter operator/developer handoff, use the production integration playbook /agenticdome/agenticdome-python-sdk/blob/main/examples/PRODUCTION INTEGRATION.md . It includes the attachment boundary, bypass warning and production proof checklist for every supported framework without exposing private policy or detection internals. | Runtime | SDK module | Global code location | Required code action | Tool-level enforcement | |---|---|---|---|---| | agenticdome sdk.crewai import agenticdome sdk.crewai once for global hooks, or AgenticDomeCrewAIFirewall .attach ... for scoped hooks secure tool ... for explicit local wrapper enforcement, schema validation, sanitized-argument execution PydanticAI pydanticai agenticdome sdk.pydantic Agent ... and tool is constructed CyberSecFirewall ... + create hooks , install native hooks agent , or attach to agent agent @firewall.secure tool ... with optional tool schema validation LangGraph langgraph agenticdome sdk.langgraph StateGraph or LangChain create agent is assembled input node / transition node / graph transition node / output node , or as langchain middleware wrap agent node , wrap tool node , security route for blocked edges Microsoft Agent Framework microsoft-agent-framework agenticdome sdk.microsoft agent framework create middleware , install on agent , or run agent securely @firewall.secure tool , wrap tool handler , secure delegated tool , wrap delegated tool handler Microsoft AutoGen microsoft-autogen agenticdome sdk.autogen wrap team , create intervention handler , create termination condition , attach agentchat agent , or attach conversable agent FunctionCall authorization plus inherited wrap tool handler / secure tool Microsoft AI Foundry microsoft-ai-foundry agenticdome sdk.microsoft ai foundry create middleware , install on client , or run secure wrap tool executor , @firewall.secure tool ... , before tool call , delegation verifiers OpenAI Agents SDK openai-agents-sdk agenticdome sdk.openai agents Agent , Runner.run ... , @function tool , guardrails, or handoffs are declared run agent securely , run agent stream securely , create input guardrail , create output guardrail wrap tool handler , wrap delegated tool handler , @firewall.secure tool ... , handoff verifiers Claude Agent SDK claude-agent-sdk agenticdome sdk.claude ClaudeAgentOptions , ClaudeSDKClient , SDK MCP tools, or query install on options plus run client securely , or secure query PreToolUse / PostToolUse hooks, wrap tool handler , and secure sdk tool smolagents hugging-face-smolagents agenticdome sdk.smolagents CodeAgent , ToolCallingAgent , tools, or managed agents run agent securely or attach firewall Tool wrappers, CodeAgent executor proxy, observation callback, and managed-agent token verification Agno agno agenticdome sdk.agno Agent , Team, Workflow, or AgentOS components are declared attach firewall agent or team , create hook bundle , create middleware , or create plugin @firewall.secure tool ... for high-risk local tools Google ADK google-adk agenticdome sdk.google adk LlmAgent ... or ADK plugins are declared build callback kwargs , create plugin , or install on agent ... wrap tool handler or @firewall.secure tool ... LlamaIndex llamaindex agenticdome sdk.llamaindex run query securely , wrap query engine , wrap retriever , create node postprocessor , create callback handler wrap tool function , to function tool , @firewall.secure tool ... , handoff verifiers AWS Bedrock aws-bedrock agenticdome sdk.aws bedrock converse ... , invoke model ... , invoke agent ... , action-group Lambdas, or retrieval converse securely , converse stream securely , invoke model securely , invoke model with response stream securely , invoke agent securely wrap tool handler , @firewall.secure tool ... , wrap action group lambda , delegation verifiers MCP host / gateway mcp-host--gateway agenticdome sdk.mcp host preflight request or forward with firewall around the forwarder authorize manager handoff and verify decision token if present ; SDK-managed security metadata never reaches the upstream server Custom Python core-sdk-client-custom-runtimes agenticdome sdk.client guardrail validate before prompts/tools; mesh validate before returning output a2a authorize tool and a2a verify decision token rpc for delegationIn production, wire AgenticDome at every local boundary your process controls: prompt ingress, tool execution, delegation handoff, specialist execution, and output egress. Every integration follows the same template: install → attach → secure tools → delegate safely → notes . Capability details and configuration snippets are collapsible so you can scan the happy path first. One import in your bootstrap registers global hooks for before llm call , before tool call , and after tool call — prompt screening, tool authorization, and output DLP across every crew in the process. pip install "agenticdome-python-sdk crewai " python from crewai import Agent, Crew, Task Importing this module registers AgenticDome global before/after hooks. import agenticdome sdk.crewai noqa: F401 manager = Agent role="Operations Manager", goal="Coordinate cross-functional tasks and delegate to specialist units", backstory="Corporate coordinator responsible for resource routing.", allow delegation=True, researcher = Agent role="Research Specialist", goal="Extract analytical records from approved secure repositories", backstory="Analytical expert executing restricted tasks under policy control.", task = Task description="Analyze database outputs and pass a summary report to the operations manager.", expected output="A structured analytical report.", agent=manager, crew = Crew agents= manager, researcher , tasks= task result = crew.kickoff Scoped attachment — use the class facade for explicit hook functions, scoped attach/unregister, or a test-local client and token store additive to the global import : python from agenticdome sdk.crewai import AgenticDomeCrewAIFirewall firewall = AgenticDomeCrewAIFirewall firewall.attach crew ... run a scoped test or runtime ... firewall.unregister crew Secure high-risk tools explicitly — if AgenticDome returns sanitized arguments, the wrapper executes the tool with those sanitized values: @firewall.secure tool tool name="crm.customer.read", tool platform="crm", tool schema={"required": "customer id" , "properties": {"customer id": {"type": "string"}}}, def lookup customer agent, customer id: str : return crm.get customer customer id Security flow: 1 prompts are screened before the LLM is called; 2 tool name, clean arguments, session context, agent identity, and policy metadata are validated before execution; 3 manager→specialist delegation is authorized and can return a decision token; 4 the specialist's token is verified through the assigned runtime and consumed once using the configured SDK state store; 5 output is reviewed and can be redacted, blocked, or preserved as structured output before leaving the runtime. CrewAI capabilities, configuration, and imports Supports: prompt screening before LLM calls · direct tool authorization · manager-to-specialist handoff authorization with explicit target metadata · specialist-side delegated execution verification using SDK-managed, one-time shared state · sanitized tool arguments and optional schema validation · output DLP with structured-output preservation and sanitized JSON parsing · streaming sanitization via sanitize streaming response · production mode with stable session ID requirements · local size limits, rate limits, retries/backoff, circuit breaker, audit logs, OpenTelemetry events, and emergency deny lists. export AGENTICDOME PLATFORM="crewai" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME CREWAI MAX INPUT CHARS="50000" export AGENTICDOME CREWAI MAX OUTPUT CHARS="100000" export AGENTICDOME CREWAI MAX TOOL ARG CHARS="20000" export AGENTICDOME CREWAI RATE LIMIT PER MINUTE="120" export AGENTICDOME CREWAI RETRY ATTEMPTS="2" export AGENTICDOME CREWAI CIRCUIT BREAKER FAILURES="5" export AGENTICDOME CREWAI AUDIT LOGGING="true" export AGENTICDOME CREWAI OTEL ENABLED="true" Optional for distributed multi-worker delegation: export AGENTICDOME REDIS URL="redis://localhost:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:crewai:handoff" export AGENTICDOME TOKEN HMAC SECRET="replace-with-secret-from-your-secret-manager" python import agenticdome sdk.crewai from agenticdome sdk.crewai import CONFIG, CLIENT, AgenticDomeCrewAIFirewall, DecisionTokenRecord, DecisionTokenStore, InMemoryDecisionTokenStore, RedisDecisionTokenStore, AgenticDome before tool call, AgenticDome after tool call, AgenticDome before llm call, sanitize streaming response, attach firewall, unregister firewall, Attach lifecycle hooks where each Agent ... is constructed, and always decorate tools that access data, systems, or external actions. pip install "agenticdome-python-sdk pydanticai " python import os from typing import Any from pydantic ai import Agent, RunContext from agenticdome sdk.pydantic import CyberSecFirewall, FirewallConfig 1. Instantiate the enterprise firewall capability. firewall = CyberSecFirewall config=FirewallConfig api base=os.environ "AGENTICDOME API BASE" , api key=os.environ "AGENTICDOME API KEY" , tenant id=os.environ "AGENTICDOME TENANT ID" , fail closed=True, block on sensitive output=True, 2. Define your PydanticAI Agent. customer support agent = Agent "gemini-2.5-flash", name="customer support agent", result type=str, system prompt="You are a helpful customer platform support assistant.", 3. Prefer native PydanticAI Hooks where your version supports capabilities. You can also pass firewall.create hooks at Agent construction via capabilities= ... . firewall.install native hooks customer support agent Legacy PydanticAI versions can still use compatibility lifecycle hooks. firewall.attach to agent customer support agent 4. Protect capability tools using the perimeter decorator. @customer support agent.tool @firewall.secure tool tool name="customer.profile.read", tool platform="crm", tool schema={ "required": "user id" , "properties": {"user id": {"type": "string"}}, }, async def fetch user profile ctx: RunContext Any , user id: str - dict: """Retrieves account management metadata profiles for a corporate ID.""" return { "user id": user id, "status": "active", "passport number": "A-1234567", } Manual firewall usage — in custom routers, test harnesses, or execution gateways: async for safe chunk in firewall.sanitize streaming response chunks=agent stream, agent id="customer support agent", session id="sess prod 01J4X", : yield safe chunk PydanticAI capabilities, version notes, and imports Supports: prompt ingress checks via legacy lifecycle hooks where available · native Hooks capability creation through create hooks for current PydanticAI versions · tool perimeter authorization via @firewall.secure tool ... · Pydantic/JSON-schema argument validation and sanitized-argument execution · manager/specialist delegation with SDK-managed, integrity-protected shared state · egress output DLP with correct block on sensitive output semantics · structured-output preservation sanitized JSON parsed back to dicts/lists · stable session ID enforcement in production mode · local rate limits, size limits, retries, circuit breaker, audit logging, OpenTelemetry span events · streaming sanitization · identity-rich policy context from ctx , deps , or nested identity/principal objects · emergency deny lists. Version notes: PydanticAI lifecycle hook APIs have evolved. Current PydanticAI documents pydantic ai.capabilities.Hooks for lifecycle interception across runs, model requests, tool validation/execution, output processing, and event streams. Prefer create hooks / install native hooks on current runtimes; keep @firewall.secure tool ... on sensitive tools as a hard enforcement boundary. If legacy lifecycle decorators are available, attach to agent attaches prompt ingress and egress DLP hooks; if not, @firewall.secure tool ... still protects tool execution. AGENTICDOME BLOCK ON SENSITIVE OUTPUT=true means AgenticDome may ask Mesh to block sensitive output; the SDK only blocks when the policy response verdict is BLOCKED . from agenticdome sdk.pydantic import CyberSecFirewall, FirewallConfig, PydanticAIFirewallError, PydanticAIFirewallDenied, PydanticAIFirewallConfigurationError, DecisionTokenRecord, DecisionTokenStore, InMemoryDecisionTokenStore, RedisDecisionTokenStore, Three production patterns: explicit firewall nodes when you own the graph topology, wrappers when you already have nodes, and LangChain middleware when you use create agent ..., middleware= ... . pip install "agenticdome-python-sdk langgraph " Pattern 1 — explicit firewall nodes clear security boundaries before input, before tools, before final output : python import os from langgraph.graph import END, START, StateGraph from agenticdome sdk.langgraph import AgentState, AgenticDomeLangGraphFirewall, FirewallConfig firewall = AgenticDomeLangGraphFirewall config=FirewallConfig api base=os.environ "AGENTICDOME API BASE" , api key=os.environ "AGENTICDOME API KEY" , tenant id=os.environ "AGENTICDOME TENANT ID" , fail closed=True, production mode=True, require explicit session id=True, rate limit per minute=120, max tool arg chars=20 000, async def agent node state: AgentState - AgentState: Your normal LangGraph agent/model node. It may append AIMessage objects with tool calls; transition node authorizes those calls before a tool node. return state async def tool node state: AgentState - AgentState: Your normal LangGraph tool execution node. return state graph = StateGraph AgentState graph.add node "input firewall", firewall.input node agent id="support orchestrator" graph.add node "agent", agent node graph.add node "transition firewall", firewall.transition node agent id="support orchestrator" graph.add node "tools", tool node graph.add node "output firewall", firewall.output node agent id="support orchestrator" graph.add edge START, "input firewall" graph.add edge "input firewall", "agent" graph.add edge "agent", "transition firewall" graph.add edge "transition firewall", "tools" graph.add edge "tools", "output firewall" graph.add edge "output firewall", END compiled = graph.compile result = await compiled.ainvoke { "session id": "sess prod 01J4X", "messages": {"role": "user", "content": "Check the customer refund status."} , "agent id": "support orchestrator", } Pattern 2 — wrap existing nodes without changing their internals: secure agent node = firewall.wrap agent node existing agent node, agent id="claims agent", screen input=True, sanitize output=True, secure tool node = firewall.wrap tool node existing tool node, agent id="claims agent", sanitize tool output=True, Pattern 3 — LangChain agent middleware: python from langchain.agents import create agent agent = create agent model="openai:gpt-4.1-mini", tools= lookup customer, create refund , middleware= firewall.as langchain middleware agent id="support agent" , Delegation — a manager node requests a specialist handoff by adding an AgenticDome.handoff or top-level handoff payload to graph state; the firewall authorizes it and stores the decision token in state plus the token store: state "AgenticDome" = { "handoff": { "target agent id": "refund specialist", "delegated tool name": "payments.refund.create", "delegated tool args": { "customer id": "cust 123", "amount": 250, "currency": "AUD", }, "tool platform": "payments", "text": "Manager delegates refund execution to a specialist agent.", } } Specialist execution is verified when the delegated tool call reaches authorize transition or a wrapped tool node. The SDK carries or recovers integrity-protected delegation state and consumes it once. Applications should use the public handoff/wrapper APIs rather than create, inspect or forward the SDK's internal metadata. Hardening helpers — policy-control sensitive graph edges; blocked states set AgenticDome.route and next agent id to security block : graph.add node "authorize escalation", firewall.graph transition node from node="triage", to node="refund specialist", agent id="support orchestrator", , graph.add conditional edges "authorize escalation", firewall.security route, {"continue": "refund specialist", "security block": "security block"}, Use sanitize retrieval documents before adding retrieved chunks to model context, and sanitize streaming events for async event streams — both use the same Mesh output policy path as final-output sanitization. LangGraph capabilities, interception notes, and imports Supports: prompt ingress via screen input / input node · tool-call authorization via authorize transition / transition node · delegation authorization from documented handoff fields · specialist-side verification using SDK-managed one-time state · sanitized tool-argument mutation before local execution · final message and tool-output DLP via sanitize output / output node · retrieval and streaming sanitization · graph transition authorization · security block routing · wrappers for existing agent and tool nodes. Interception notes: LangGraph is graph-native — reliable interception means inserting security nodes or wrapping nodes/tool nodes. LangChain's modern create agent supports a middleware parameter documented as the way to intercept model, tool, and agent-loop behavior; as langchain middleware targets that style, and the adapter mutates sanitized tool arguments back into the tool request for local execution. For custom StateGraph workflows, implement middleware as graph nodes or wrappers at the boundaries you must enforce: before model input, before tool execution, before handoff execution, and before final output. Remote or provider-hosted tools that execute outside your Python process can only be guarded at the local request/response boundary. Official references: LangChain middleware overview https://docs.langchain.com/oss/python/langchain/middleware/overview · LangChain create agent reference https://reference.langchain.com/python/langchain/agents/ langchain.agents.create agent from agenticdome sdk.langgraph import AgentState, AgenticDomeLangGraphFirewall, AgenticDomeLangChainMiddleware, FirewallConfig, AgenticDomeDenied, AgenticDomeConfigurationError, DecisionTokenRecord, InMemoryDecisionTokenStore, RedisDecisionTokenStore, Boundary-oriented async firewall: protect the run boundary, local function-tool handlers, delegated specialist tools, and final output. It does not monkey-patch every Microsoft provider or hosted tool surface. pip install "agenticdome-python-sdk microsoft " Install the Microsoft Agent Framework packages used by your application separately — the AgenticDome helper is dependency-light because deployments vary across local function tools, hosted tools, Foundry agents, Copilot Studio, A2A agents, workflow executors, and custom clients. Secure a local function tool — wrap the callable that actually executes, so arguments are authorized before execution and results sanitized after. If AgenticDome returns sanitized tool args , the wrapped handler receives those safe arguments instead of the model-provided originals: python import os from typing import Annotated from pydantic import Field from agent framework import tool from agenticdome sdk.microsoft agent framework import AgenticDomeMicrosoftAgentFirewall firewall = AgenticDomeMicrosoftAgentFirewall async def raw get customer profile ctx, args : customer id = args "customer id" return { "customer id": customer id, "email": "alice@example.com", "risk": "medium", } secure get customer profile = firewall.wrap tool handler tool name="crm.customer profile.read", handler=raw get customer profile, tool platform="crm", @tool approval mode="never require" async def get customer profile customer id: Annotated str, Field description="Customer identifier" , - str: Adapt this context object to your runtime. It should expose session id/run id and agent identity if available. ctx = { "session id": "sess prod 01J4X", "agent name": "customer support agent", } return await secure get customer profile ctx, {"customer id": customer id} Native-style middleware hooks — a harder-to-bypass assembly-level integration where the runtime exposes middleware or callbacks; before tool call returns the sanitized tool arguments to forward to the local executor: firewall = AgenticDomeMicrosoftAgentFirewall agent = firewall.install on agent agent middleware = firewall.create middleware The returned middleware exposes async hook methods: before agent run ctx, input text after agent run ctx, output before tool call ctx, tool name, tool args after tool call ctx, tool name, result Secure the whole agent run boundary — prompt ingress plus final-output DLP: result = await firewall.run agent securely run callable=agent.run, input text="Find the customer's refund status.", session id="sess prod 01J4X", agent id="refund agent", policy context={"request purpose": "customer support"}, output extractor=lambda value: getattr value, "text", str value , Delegated specialist pattern — authorize at the manager, verify at the specialist: authorization = await firewall.authorize manager handoff text="Manager delegates refund execution to a payment specialist.", manager agent id="support manager", specialist agent id="payments specialist", tool name="payments.refund.create", tool args={"customer id": "cust 123", "amount": 250, "currency": "AUD"}, session id="sess prod 01J4X", tool platform="payments", secure refund handler = firewall.wrap delegated tool handler tool name="payments.refund.create", handler=raw refund handler, Microsoft Agent Framework capabilities, configuration, notes, and imports Supports: prompt ingress via screen input , middleware hooks, or run agent securely · function-tool authorization with sanitized-argument enforcement · manager-to-specialist delegation and specialist verification through public wrapper APIs · stable session ID enforcement for production · Entra/principal identity context propagation · output DLP with structured JSON preservation and optional response-object mutation · streaming sanitization · OpenTelemetry events and structured audit logging · local rate limits, size limits, retries, circuit breaker · optional Copilot / AI Foundry threat helper enforcement · shared multi-worker delegation state · emergency deny lists. export AGENTICDOME PLATFORM="microsoft agent framework v1" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME MSAF MAX INPUT CHARS="50000" export AGENTICDOME MSAF MAX OUTPUT CHARS="100000" export AGENTICDOME MSAF MAX TOOL ARG CHARS="20000" export AGENTICDOME MSAF RATE LIMIT PER MINUTE="0" export AGENTICDOME MSAF RETRY ATTEMPTS="2" export AGENTICDOME MSAF CIRCUIT BREAKER FAILURES="5" export AGENTICDOME MSAF CIRCUIT BREAKER RESET S="60" export AGENTICDOME MSAF AUDIT LOGGING="true" export AGENTICDOME MSAF OTEL ENABLED="true" Optional local emergency controls: export AGENTICDOME MSAF EMERGENCY BLOCK TOOLS="payments.refund.create" export AGENTICDOME MSAF EMERGENCY BLOCK AGENTS="legacy agent" Optional integrity secret for SDK-managed shared delegation state: export AGENTICDOME TOKEN HMAC SECRET="change-me" Optional Copilot / AI Foundry helper enforcement: export AGENTICDOME ENABLE COPILOT THREAT API="true" export AGENTICDOME ENFORCE COPILOT THREAT API="true" Notes: the framework's tool-approval feature is human-in-the-loop gating, not policy enforcement, DLP, or tenant-aware A2A token verification — AgenticDome should sit at the local tool handler or workflow executor boundary for deterministic enforcement. Wrap the executor/run boundary or the tool/executor functions that process sensitive actions. Tools that execute remotely hosted providers, Foundry agents, Copilot Studio, hosted MCP servers, remote A2A agents can only be protected at the local request/response boundary. In production, pass stable session id / run id / trace id values and Entra/principal identity fields in context. Official references: Agent Framework docs https://learn.microsoft.com/en-us/agent-framework/ · Tools overview https://learn.microsoft.com/en-us/agent-framework/agents/tools/ · Workflow execution https://learn.microsoft.com/en-us/agent-framework/workflows/workflows from agenticdome sdk.microsoft agent framework import AgenticDomeMicrosoftAgentFirewall, FirewallConfig, load config, MicrosoftAgentFirewallDenied, MicrosoftAgentFirewallError, DecisionTokenRecord, InMemoryDecisionTokenStore, RedisDecisionTokenStore, AutoGen is Microsoft's open-source conversational multi-agent framework and is now community-managed in maintenance mode; Microsoft Agent Framework is the recommended successor for new systems. AgenticDome supports current AutoGen AgentChat/Core applications and existing legacy ConversableAgent deployments so teams can migrate without losing runtime enforcement. AutoGen AgentChat requires Python 3.10+. pip install "agenticdome-python-sdk autogen " Protect a current AgentChat team — the wrapper screens the initial task, every streamed team event, and final messages while retaining the underlying Team API: python from autogen agentchat.teams import RoundRobinGroupChat from agenticdome sdk.autogen import AgenticDomeAutoGenFirewall firewall = AgenticDomeAutoGenFirewall team = RoundRobinGroupChat planner, researcher, payments specialist , max turns=12 secure team = firewall.wrap team team, session id="sess prod 01J4X", agent id="customer operations team", policy context={"request purpose": "customer support"}, result = await secure team.run task=user prompt Authorize AutoGen Core tool traffic at the runtime boundary — current AutoGen sends FunctionCall messages to tool agents, so the intervention handler is a stronger boundary than patching an individual assistant: python from autogen core import SingleThreadedAgentRuntime handler = firewall.create intervention handler session id="sess prod 01J4X", agent id="autogen planner", runtime = SingleThreadedAgentRuntime intervention handlers= handler Freeze a group chat on behavioral drift — compose the AgenticDome condition with AutoGen's normal termination conditions: agenticdome stop = firewall.create termination condition session id="sess prod 01J4X", agent id="customer operations team", team = RoundRobinGroupChat planner, researcher, payments specialist , termination condition=agenticdome stop | normal stop, max turns=12, Family 2 policy receives a bounded rolling conversation window digest, participant lineage, semantic-deviation evaluation request, and tool-call frequency. A blocked cross-agent message or excessive tool rate freezes the local session, reports a trust incident, and advances revocation state for the emitting agent before an external action can run. Existing AutoGen 0.2 deployments — attach to the legacy ConversableAgent.send , receive , a send , and a receive lifecycles: Keep the customer's already-certified legacy AutoGen dependency in place and install the dependency-light base SDK do not use the autogen extra, because that extra deliberately installs the current AgentChat release : pip install agenticdome-python-sdk assistant = firewall.attach conversable agent assistant, session id="sess prod 01J4X", agent id="legacy autogen assistant", user proxy = firewall.attach conversable agent user proxy, session id="sess prod 01J4X", agent id="legacy autogen user proxy", Wrap side-effecting local tools as well; conversation screening does not replace authorization at the execution boundary: secure refund = firewall.wrap tool handler tool name="payments.refund.create", tool platform="payments", handler=raw refund, session id="sess prod 01J4X", agent id="payments specialist", export AGENTICDOME PLATFORM="autogen" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME AUTOGEN CONVERSATION WINDOW="12" export AGENTICDOME AUTOGEN MAX TOOL CALLS PER WINDOW="8" export AGENTICDOME AUTOGEN FREEZE ON BLOCK="true" export AGENTICDOME AUTOGEN REVOKE ON FREEZE="true" Official references: AutoGen project status and migration guidance https://github.com/microsoft/autogen · AgentChat teams https://microsoft.github.io/autogen/stable/reference/python/autogen agentchat.teams.html · Core intervention handlers https://microsoft.github.io/autogen/dev/user-guide/core-user-guide/cookbook/tool-use-with-intervention.html · Legacy 0.2 conversational agents https://microsoft.github.io/autogen/0.2/docs/Use-Cases/agent chat/ For services that call Foundry agents, handle function-call requests from Foundry, execute local function tools, or use FoundryChatClient with local tools. pip install "agenticdome-python-sdk foundry " The adapter itself is dependency-light; the foundry extra installs common Azure SDK packages azure-ai-projects , azure-identity for applications using Foundry directly. Authentication model — Foundry threat-contract calls use bearer auth; Mesh output DLP and incident reporting use API-key auth. In production mode, output sanitization is required by default: export AGENTICDOME API BASE="https://demo-sidecar.agenticdome.io" export AGENTICDOME BEARER TOKEN="your foundry threat contract bearer token" export AGENTICDOME API KEY="your api key" export AGENTICDOME TENANT ID="your tenant id" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME FOUNDRY REQUIRE OUTPUT SANITIZATION IN PROD="true" Optional only when delegated execution crosses processes/workers/pods: export AGENTICDOME REDIS URL="redis://redis.internal:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:foundry:handoff" export AGENTICDOME TOKEN HMAC SECRET="replace-with-secret-from-kms" Attach middleware, then secure the run boundary: python from agenticdome sdk.microsoft ai foundry import AgenticDomeMicrosoftAIFoundryFirewall firewall = AgenticDomeMicrosoftAIFoundryFirewall foundry client = firewall.install on client foundry client For custom runtimes, register the middleware object explicitly. middleware = firewall.create middleware await middleware.before run ctx, input text result = await foundry agent.run input text result = await middleware.after run ctx, result result = await firewall.run secure run callable=foundry agent.run, input text="Find the customer's refund status.", ctx={ "agent id": "foundry refund agent", "session id": "sess prod 01J4X", "user id": "user 123", }, output extractor=lambda value: getattr value, "text", str value , Secure local function-tool execution — at the exact boundary before your app submits function output back to Foundry: python async def raw lookup customer ctx, args : return {"customer id": args "customer id" , "email": "alice@example.com"} secure lookup customer = firewall.wrap tool executor tool name="crm.customer.read", tool platform="crm", handler=raw lookup customer, tool schema={ "required": "customer id" , "properties": {"customer id": {"type": "string"}}, }, result = await secure lookup customer {"agent id": "foundry support agent", "session id": "sess prod 01J4X"}, {"customer id": "cust 123"}, Decorator form: @firewall.secure tool tool name="payments.refund.create", tool platform="payments", tool schema={ "required": "customer id", "amount cents" , "properties": { "customer id": {"type": "string"}, "amount cents": {"type": "integer"}, }, }, def create refund ctx, args : return {"refund id": "rfnd 123", "status": "created"} Delegated Foundry tool execution — authorization stores decision state in memory by default. Configure the optional Redis store only when the specialist executes in another process, worker, or pod; the specialist consumes and verifies the decision before executing: await firewall.authorize manager handoff text="Ask the billing specialist to create a refund.", manager agent id="foundry manager", specialist agent id="billing specialist", tool name="payments.refund.create", tool args={"customer id": "cust 123", "amount cents": 2500}, session id="sess prod 01J4X", tool platform="payments", await firewall.verify delegated execution specialist agent id="billing specialist", tool name="payments.refund.create", tool args={"customer id": "cust 123", "amount cents": 2500}, session id="sess prod 01J4X", Streaming output sanitization: async for safe chunk in firewall.sanitize streaming response chunks=foundry stream, agent id="foundry support agent", session id="sess prod 01J4X", : yield safe chunk Microsoft AI Foundry capabilities, notes, and imports Supports: prompt/run validation via validate prompt contract , before run , or run secure · middleware hooks via create middleware / install on client · local function-tool analysis via analyze tool execution , before tool call , or wrap tool executor · @firewall.secure tool ... for high-risk callables · lightweight JSON-schema validation and sanitized-argument execution · enterprise identity context propagation for Entra IDs, roles/scopes, Foundry project IDs, and Purview/sensitivity labels · production-mode stable session ID and output-sanitization requirements · output DLP through Mesh · structured-output preservation · local rate limits, size limits, retries, circuit breaker, audit logging, OpenTelemetry span events · streaming sanitization · optional handoff authorization and SDK-managed multi-worker verification · emergency deny lists. Notes: Foundry function calling asks your application to execute local functions and return tool output — wrap that local execution before output is submitted back to Foundry. Production deployments should pass a stable session id , run id , trace id , conversation id , or thread id ; generated fallback IDs are for local development only. Pass Entra identity, roles/scopes, Foundry project IDs, and Purview/sensitivity labels on ctx or policy context for identity-aware server-side policy. Hosted tools executing entirely inside a remote provider runtime can only be protected at the local request/response boundary. Threat-contract prompt and tool analysis additionally require AGENTICDOME BEARER TOKEN . Official references: Foundry function calling https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/function-calling · Foundry agents quickstart https://learn.microsoft.com/en-us/azure/ai-foundry/agents/quickstart from agenticdome sdk.microsoft ai foundry import AgenticDomeMicrosoftAIFoundryFirewall, FirewallConfig, MicrosoftAIFoundryDenied, MicrosoftAIFoundryFirewallError, MicrosoftAIFoundryConfigurationError, DecisionTokenRecord, DecisionTokenStore, InMemoryDecisionTokenStore, RedisDecisionTokenStore, The OpenAI Agents SDK ships agents, function tools, guardrails, handoffs, sessions, streaming, and tracing; AgenticDome complements those primitives by enforcing tenant policy before local tool execution, validating delegated specialist execution, and sanitizing outputs before they leave the runtime. pip install "agenticdome-python-sdk openai-agents " installs the openai-agents package Secure a runner boundary: python from agents import Agent, Runner from agenticdome sdk.openai agents import AgenticDomeOpenAIAgentsFirewall firewall = AgenticDomeOpenAIAgentsFirewall agent = Agent name="support agent", instructions="Help support users safely." result = await firewall.run agent securely runner=Runner, agent=agent, input text="Check customer refund status.", session id="sess prod 01J4X", For streamed runs, use run agent stream securely or pass the stream through sanitize streaming response before returning chunks. Register guardrail helpers where your wiring supports input/output guardrail slots — but keep tool authorization at function-tool boundaries, because tool execution can happen multiple times inside one run: input guardrail = firewall.create input guardrail output guardrail = firewall.create output guardrail Secure a function tool — wrap the local implementation before exposing it with @function tool ; sanitized arguments replace originals and SDK-managed security metadata is never passed to the business handler: python from agents import function tool async def raw lookup customer ctx, args : return {"customer id": args "customer id" , "email": "alice@example.com"} secure lookup customer = firewall.wrap tool handler tool name="crm.customer.read", tool platform="crm", tool schema={"required": "customer id" , "properties": {"customer id": {"type": "string"}}}, handler=raw lookup customer, @function tool async def lookup customer customer id: str - str: return await secure lookup customer {"agent id": "support agent", "session id": "sess prod 01J4X"}, {"customer id": customer id}, Delegated specialist tool pattern: await firewall.authorize manager handoff session id="sess prod 01J4X", manager agent id="triage agent", specialist agent id="refund agent", tool name="payments.refund.create", tool args={"customer id": "cust 123", "amount": 250}, text="Triage agent delegates refund creation to refund specialist.", tool platform="payments", secure refund tool = firewall.wrap delegated tool handler tool name="payments.refund.create", handler=raw refund handler, OpenAI Agents SDK capabilities, configuration, notes, and imports Supports: prompt ingress via screen input , run agent securely , run agent stream securely , or create input guardrail · function-tool authorization via wrap tool handler / @firewall.secure tool ... · sanitized arguments and optional schema validation · handoff authorization via authorize manager handoff · specialist-side verification via verify specialist execution and wrap delegated tool handler · SDK-managed one-time multi-worker delegation state · output DLP via sanitize output and create output guardrail · streaming sanitization · structured-output preservation and sanitized JSON parsing · production mode with stable session IDs · size limits, rate limits, retries/backoff, circuit breaker, audit logs, OpenTelemetry events, identity-rich policy context, emergency deny lists. export AGENTICDOME PLATFORM="openai agents sdk" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME OPENAI AGENTS MAX INPUT CHARS="50000" export AGENTICDOME OPENAI AGENTS MAX OUTPUT CHARS="100000" export AGENTICDOME OPENAI AGENTS MAX TOOL ARG CHARS="20000" export AGENTICDOME OPENAI AGENTS RATE LIMIT PER MINUTE="120" export AGENTICDOME OPENAI AGENTS RETRY ATTEMPTS="2" export AGENTICDOME OPENAI AGENTS CIRCUIT BREAKER FAILURES="5" export AGENTICDOME OPENAI AGENTS AUDIT LOGGING="true" export AGENTICDOME OPENAI AGENTS OTEL ENABLED="true" Optional for distributed multi-worker delegation: export AGENTICDOME REDIS URL="redis://localhost:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:openai agents:handoff" export AGENTICDOME TOKEN HMAC SECRET="replace-with-secret-from-your-secret-manager" Notes: guardrails are useful at run boundaries, but side-effecting local tools still need function-tool wrappers. Handoffs are represented as tools to the model, so manager-to-specialist policy should be enforced where handoff/tool execution is invoked. Hosted tools, MCP tools, and remote runtimes can only be protected at the local request/response boundary. Use stable session id / run id / trace id / conversation id / thread id values and Redis-backed token storage when authorization and execution can happen in different workers. Official references: Overview https://openai.github.io/openai-agents-python/ · Tools https://openai.github.io/openai-agents-python/tools/ · Guardrails https://openai.github.io/openai-agents-python/guardrails/ · Handoffs https://openai.github.io/openai-agents-python/handoffs/ from agenticdome sdk.openai agents import AgenticDomeOpenAIAgentsFirewall, FirewallConfig, OpenAIAgentsFirewallDenied, OpenAIAgentsFirewallError, DecisionTokenRecord, DecisionTokenStore, InMemoryDecisionTokenStore, RedisDecisionTokenStore, The adapter uses Claude Agent SDK's native hook contract for prompt submission, pre-tool permission decisions, and post-tool output replacement. It also wraps the asynchronous query and ClaudeSDKClient.receive response pipelines so final assistant text is reviewed before your application returns it. pip install "agenticdome-python-sdk claude " Secure a ClaudeSDKClient and its built-in/MCP tools: python from claude agent sdk import ClaudeAgentOptions, ClaudeSDKClient from agenticdome sdk.claude import AgenticDomeClaudeFirewall firewall = AgenticDomeClaudeFirewall options = ClaudeAgentOptions allowed tools= "Read", "mcp crm lookup" firewall.install on options options, session id="sess prod 01J4X", agent id="claude support agent", async with ClaudeSDKClient options=options as client: async for message in firewall.run client securely client, "Look up the customer's active support case.", session id="sess prod 01J4X", agent id="claude support agent", : consume message For the one-shot API, iterate firewall.secure query prompt, session id=..., options=... . If the run may execute built-in tools, install the returned hook matchers on its options as well; secure query itself covers ingress and returned messages. Compose with Claude's native SDK MCP @tool: @firewall.secure sdk tool "lookup customer", "Look up a customer support profile", {"customer id": str}, session id="sess prod 01J4X", agent id="claude support agent", tool platform="crm", async def lookup customer args : return {"content": {"type": "text", "text": crm lookup args "customer id" } } The PreToolUse hook returns Claude's native permissionDecision: deny response before local side effects. If policy supplies sanitized arguments, it returns updatedInput . The PostToolUse hook uses updatedToolOutput so DLP-reviewed tool data is what the model sees. export AGENTICDOME PLATFORM="claude agent sdk" export AGENTICDOME CLAUDE AGENT ID="claude support agent" export AGENTICDOME CLAUDE MAX INPUT CHARS="50000" export AGENTICDOME CLAUDE MAX OUTPUT CHARS="100000" export AGENTICDOME CLAUDE MAX TOOL ARG CHARS="20000" export AGENTICDOME CLAUDE STREAMING BUFFER CHARS="4000" export AGENTICDOME CLAUDE RATE LIMIT PER MINUTE="60" export AGENTICDOME CLAUDE RETRY ATTEMPTS="2" export AGENTICDOME CLAUDE RETRY BACKOFF S="0.25" export AGENTICDOME CLAUDE CIRCUIT BREAKER FAILURES="5" export AGENTICDOME CLAUDE CIRCUIT BREAKER RESET S="60" export AGENTICDOME CLAUDE AUDIT LOGGING="true" export AGENTICDOME CLAUDE OTEL ENABLED="true" export AGENTICDOME CLAUDE STRICT DELEGATED EXECUTION="true" export AGENTICDOME CLAUDE EMERGENCY BLOCK TOOLS="" export AGENTICDOME CLAUDE EMERGENCY BLOCK AGENTS="" Use authorize manager handoff and verify specialist execution when a manager delegates sensitive work. Configure the documented shared store and integrity secret when authorization and specialist execution can land on different workers. Claude hooks protect operations visible to the local SDK process; externally hosted services still require enforcement at their local gateway or MCP host. Official references: Claude Agent SDK Python https://github.com/anthropics/claude-agent-sdk-python · Claude Agent SDK overview https://platform.claude.com/docs/en/agent-sdk/overview smolagents CodeAgent generates Python and invokes python executor code before step callbacks run. The adapter therefore wraps the executor itself, wraps every native Tool , sanitizes step observations before the next model turn, and enforces managed-agent handoffs with bound decision tokens. pip install "agenticdome-python-sdk smolagents " python from smolagents import CodeAgent, InferenceClientModel, tool from agenticdome sdk.smolagents import AgenticDomeSmolagentsFirewall @tool def lookup customer customer id: str - str: """Look up a customer by ID.""" return crm lookup customer id agent = CodeAgent tools= lookup customer , model=InferenceClientModel firewall = AgenticDomeSmolagentsFirewall result = firewall.run agent securely agent, "Look up customer cust 123 for their active support case.", session id="sess prod 01J4X", agent id="smol support agent", attach firewall agent, session id=... is idempotent and can be used when another component owns agent.run . For streaming, use run agent stream securely so event output is reviewed before it is yielded. Direct agent.run after attachment still gets tool, code, managed-agent, and step-observation enforcement, but the application should use the secure run wrapper for final-output DLP. export AGENTICDOME PLATFORM="smolagents" export AGENTICDOME SMOLAGENTS AGENT ID="smol support agent" export AGENTICDOME SMOLAGENTS MAX INPUT CHARS="50000" export AGENTICDOME SMOLAGENTS MAX OUTPUT CHARS="100000" export AGENTICDOME SMOLAGENTS MAX TOOL ARG CHARS="20000" export AGENTICDOME SMOLAGENTS STREAMING BUFFER CHARS="4000" export AGENTICDOME SMOLAGENTS RATE LIMIT PER MINUTE="60" export AGENTICDOME SMOLAGENTS RETRY ATTEMPTS="2" export AGENTICDOME SMOLAGENTS RETRY BACKOFF S="0.25" export AGENTICDOME SMOLAGENTS CIRCUIT BREAKER FAILURES="5" export AGENTICDOME SMOLAGENTS CIRCUIT BREAKER RESET S="60" export AGENTICDOME SMOLAGENTS AUDIT LOGGING="true" export AGENTICDOME SMOLAGENTS OTEL ENABLED="true" export AGENTICDOME SMOLAGENTS EMERGENCY BLOCK TOOLS="" export AGENTICDOME SMOLAGENTS EMERGENCY BLOCK AGENTS="" export AGENTICDOME SMOLAGENTS STRICT DELEGATED EXECUTION="true" export AGENTICDOME SMOLAGENTS SCAN CODE EXPRESSIONS="true" Keep code-expression scanning enabled in production. It adds business-intent policy before smolagents' local or remote executor; it does not replace the executor's OS/container/WASM sandbox. The adapter intentionally sends generated code and serialized tool arguments to the configured AgenticDome sidecar, so place that sidecar within the approved trust boundary and apply normal data-residency controls. Official references: smolagents agents https://huggingface.co/docs/smolagents/main/reference/agents · smolagents tools https://huggingface.co/docs/smolagents/main/reference/tools Agno's Agent reference documents pre hooks , post hooks , and tool hooks ; the adapter attaches to those boundaries so policy is enforced before prompts/tools run and before output returns. Middleware/plugin-shaped helpers are available for applications that centralize hook registration. pip install "agenticdome-python-sdk agno " install agno separately as needed Attach firewall hooks in the module where you create the Agno Agent , Team, Workflow, or AgentOS component attach firewall is idempotent : python from agno.agent import Agent from agenticdome sdk.agno import AgenticDomeAgnoFirewall firewall = AgenticDomeAgnoFirewall support agent = Agent name="support agent", model="openai:gpt-5.5", tools= lookup customer, create refund , firewall.attach firewall support agent php pre hooks - prompt input, tool authorization, delegation authorization, token verification post hooks - final output DLP and redaction/blocking tool hooks - additional local tool boundary enforcement where Agno invokes tool hooks For centralized registration layers: hook bundle = firewall.create hook bundle middleware = firewall.create middleware plugin = firewall.create plugin Decorate high-risk tools — anything that reads sensitive data, mutates state, sends messages, writes files, calls payment systems, or triggers external APIs: @firewall.secure tool tool name="crm.customer.read", tool platform="crm", tool schema={"required": "customer id" , "properties": {"customer id": {"type": "string"}}}, def lookup customer agent, customer id: str - dict: return {"customer id": customer id, "email": "alice@example.com"} Delegation — pass target metadata in hook kwargs or tool args; AgenticDome authorizes the handoff and stores the decision token for specialist verification: firewall.pre hook manager agent, session id="sess prod 01J4X", input="Delegate refund execution to payment specialist.", tool name="delegate refund", tool platform="payments", tool args={ "target agent id": "payments specialist", "target tool name": "payments.refund.create", "target tool args": {"customer id": "cust 123", "amount": 250}, }, The specialist side verifies a token passed in args or recovers it from the configured in-process or optional Redis store; stored tokens are consumed once: firewall.pre hook payments specialist, session id="sess prod 01J4X", tool name="payments.refund.create", tool args={"customer id": "cust 123", "amount": 250}, Retrieved context and streaming sanitization — before retrieved or streamed content is shown to a user or re-enters an agent loop: safe context = firewall.sanitize retrieved text text=retrieved context, agent id="support agent", session id="sess prod 01J4X", policy context={"source": "agno knowledge"}, async for safe chunk in firewall.sanitize streaming response chunks, agent id="support agent", session id="sess prod 01J4X", : yield safe chunk Agno capabilities, configuration, notes, and imports Supports: prompt ingress via pre hook / cybersec pre hook · tool-call authorization via pre hook , tool hook , and @firewall.secure tool · sanitized arguments and optional schema validation · delegation authorization and specialist-side one-time verification through SDK-managed state · output DLP via post hook / cybersec post hook with structured-output preservation · retrieved-context sanitization for Agno knowledge/RAG pipelines · streaming sanitization · production mode with stable session IDs · size limits, rate limits, retries/backoff, circuit breaker, audit logs, OpenTelemetry events, identity-rich policy context, emergency deny lists. export AGENTICDOME PLATFORM="agno" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME AGNO MAX INPUT CHARS="50000" export AGENTICDOME AGNO MAX OUTPUT CHARS="100000" export AGENTICDOME AGNO MAX TOOL ARG CHARS="20000" export AGENTICDOME AGNO RATE LIMIT PER MINUTE="120" export AGENTICDOME AGNO RETRY ATTEMPTS="2" export AGENTICDOME AGNO CIRCUIT BREAKER FAILURES="5" export AGENTICDOME AGNO AUDIT LOGGING="true" export AGENTICDOME AGNO OTEL ENABLED="true" Optional for distributed multi-worker delegation: export AGENTICDOME REDIS URL="redis://localhost:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:agno:handoff" export AGENTICDOME TOKEN HMAC SECRET="replace-with-secret-from-your-secret-manager" Notes: environment configuration alone does not attach AgenticDome — call attach firewall agent or team , register create hook bundle , use the middleware/plugin helper, or assign cybersec pre hook , cybersec post hook , and cybersec tool hook directly. Hosted/remote tools can only be protected at the local request/response boundary. Use stable session id / run id / trace id values. Configure the optional Redis store only when delegation authorization and execution cross workers or pods. Official references: Agno SDK overview https://docs.agno.com/features/sdk · Agent reference https://docs.agno.com/reference/agents/agent from agenticdome sdk.agno import AgenticDomeAgnoFirewall, FirewallConfig, AgenticDomeAgnoDenied, DecisionTokenRecord, DecisionTokenStore, InMemoryDecisionTokenStore, RedisDecisionTokenStore, attach firewall, cybersec pre hook, cybersec post hook, cybersec tool hook, sanitize retrieved text, Register at agent construction with ADK callback keyword arguments, attach to an existing agent, or expose as a plugin-style object for ADK plugin registration. pip install "agenticdome-python-sdk google-adk " Register callbacks — build callback kwargs returns the official callback keyword names used by LlmAgent ... : python from google.adk.agents import LlmAgent from agenticdome sdk.google adk import AgenticDomeGoogleADKFirewall firewall = AgenticDomeGoogleADKFirewall agent = LlmAgent name="support adk agent", model="gemini-2.5-flash", instruction="Help support analysts safely.", firewall.build callback kwargs , firewall.install on agent agent attach to an existing agent plugin = firewall.create plugin plugin-style registration Tool protection — sanitized arguments replace originals and SDK-managed security metadata is never passed to the business handler; pass a Pydantic model, Pydantic v1 model, or JSON-schema-like dict to validate arguments: @firewall.secure tool tool name="crm.customer.read", tool platform="crm" def lookup customer tool context, args : return crm.get customer args "customer id" secured lookup = firewall.wrap tool handler tool name="crm.customer.read", tool platform="crm", tool schema={"required": "customer id" , "properties": {"customer id": {"type": "string"}}}, handler=lookup customer, Multi-agent delegation — use the public handoff methods so the adapter manages authorization state and verifies delegated execution before the specialist runs the tool: record = await firewall.authorize manager handoff source agent id="manager", target agent id="filesystem specialist", target tool name="filesystem.read", target tool args={"path": "/reports/q4.txt"}, tool context=tool context, await firewall.verify delegated execution target agent id="filesystem specialist", tool name="filesystem.read", tool args={"path": "/reports/q4.txt"}, tool context=tool context, decision token=record.decision token, Google ADK capabilities, configuration, notes, and imports Supports: prompt screening via before model · model output sanitization via after model · tool argument authorization, schema validation, and sanitized-argument enforcement via before tool · tool result sanitization with structured JSON preservation via after tool · lifecycle audit visibility via before agent / after agent · explicit wrappers via wrap tool handler / @firewall.secure tool ... · manager/specialist handoff authorization with SDK-managed one-time state · streaming sanitization with a sliding review buffer · rate limits, size limits, retries/backoff, circuit breaker, structured audit logs, OpenTelemetry span events, identity-rich policy context, emergency deny lists. export AGENTICDOME PLATFORM="google adk" export AGENTICDOME GOOGLE ADK AGENT ID="support adk agent" export AGENTICDOME SANITIZE MODEL OUTPUT="true" export AGENTICDOME SANITIZE TOOL OUTPUT="true" export AGENTICDOME PRODUCTION MODE="true" export AGENTICDOME REQUIRE STABLE SESSION ID IN PROD="true" export AGENTICDOME HANDOFF TOKEN TTL S="900" export AGENTICDOME GOOGLE ADK MAX INPUT CHARS="50000" export AGENTICDOME GOOGLE ADK MAX OUTPUT CHARS="100000" export AGENTICDOME GOOGLE ADK MAX TOOL ARG CHARS="20000" export AGENTICDOME GOOGLE ADK RATE LIMIT PER MINUTE="120" export AGENTICDOME GOOGLE ADK RETRY ATTEMPTS="2" export AGENTICDOME GOOGLE ADK CIRCUIT BREAKER FAILURES="5" export AGENTICDOME GOOGLE ADK AUDIT LOGGING="true" export AGENTICDOME GOOGLE ADK OTEL ENABLED="true" Optional for distributed multi-worker handoff verification: export AGENTICDOME REDIS URL="redis://localhost:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:google adk:handoff" export AGENTICDOME TOKEN HMAC SECRET="replace-with-secret-from-your-secret-manager" Notes: register callbacks, the plugin object, or tool wrappers — env config alone does not intercept ADK execution. Use async callback methods before model , after model , before tool , after tool when your ADK runner supports them; the callback sync methods are for synchronous configurations only. In production, provide stable ADK context values session id , run id , trace id , conversation id , request id — otherwise the adapter fails closed when AGENTICDOME REQUIRE STABLE SESSION ID IN PROD=true . The SDK protects the local ADK callback boundary and returned content, not execution inside remote tools/services. Include Google Cloud identity and project context when available. Use the documented shared store and integrity secret for multi-worker or Kubernetes deployments. from agenticdome sdk.google adk import AgenticDomeGoogleADKFirewall, DecisionTokenRecord, DecisionTokenStore, FirewallConfig, InMemoryDecisionTokenStore, RedisDecisionTokenStore, Protects the local boundaries your application controls: FunctionTool functions, query calls, query-engine tools, retrieved context, and final synthesized output. pip install "agenticdome-python-sdk llamaindex " Secure a FunctionTool before giving it to a LlamaIndex agent: python from agenticdome sdk.llamaindex import AgenticDomeLlamaIndexFirewall firewall = AgenticDomeLlamaIndexFirewall def lookup customer customer id: str - dict: return crm.get customer customer id secure lookup = firewall.to function tool lookup customer, tool name="crm.customer.read", tool platform="crm", agent id="support llamaindex agent", session id="sess prod 01J4X", Or wrap explicitly without constructing a FunctionTool: secure lookup fn = firewall.wrap tool function lookup customer, tool name="crm.customer.read", tool platform="crm", agent id="support llamaindex agent", session id="sess prod 01J4X", Query and retrieval protection — around query engines you invoke directly, and at central assembly points: answer = await firewall.run query securely query callable=query engine.query, query text="Find customer renewal risk.", agent id="support llamaindex agent", session id="sess prod 01J4X", secure query engine = firewall.wrap query engine query engine, agent id="support llamaindex agent", session id="sess prod 01J4X", secure retriever = firewall.wrap retriever retriever, agent id="support llamaindex agent", session id="sess prod 01J4X", After retrievers return nodes, before retrieved text is inserted into a prompt: safe nodes = await firewall.sanitize retrieval result retrieval result=nodes, agent id="support llamaindex agent", session id="sess prod 01J4X", For RAG pipelines that accept node postprocessors: node postprocessor = firewall.create node postprocessor agent id="support llamaindex agent", session id="sess prod 01J4X", Callback visibility — global audit visibility, incident telemetry, optional extra blocking keep hard enforcement in the wrappers; set enforce input=True only for an additional synchronous input check on callback query/prompt events : python from llama index.core import Settings from llama index.core.callbacks import CallbackManager handler = firewall.create callback handler agent id="support llamaindex agent", session id="sess prod 01J4X", Settings.callback manager = CallbackManager handler Multi-agent handoffs — only when your application delegates from managers to specialists that can execute sensitive tools: await firewall.authorize manager handoff manager agent id="triage manager", specialist agent id="billing specialist", tool name="billing.refund.create", tool args={"invoice id": "inv 123", "amount": 2500}, tool platform="billing", session id="sess prod 01J4X", await firewall.verify delegated execution specialist agent id="billing specialist", tool name="billing.refund.create", tool args={"invoice id": "inv 123", "amount": 2500}, session id="sess prod 01J4X", LlamaIndex capabilities, configuration, notes, and imports Supports: prompt/query screening before query execution · FunctionTool and local tool authorization · tool output review before results return to the agent · query output DLP and redaction · retrieval-result sanitization before retrieved context enters a prompt or reaches a user · query-engine and retriever wrappers for central assembly points · node postprocessor creation for RAG context sanitization · callback handler creation for global audit visibility and optional extra input blocking · optional handoff authorization and token verification · optional Redis-backed token storage for multi-worker deployments · optional creation of LlamaIndex FunctionTool objects when LlamaIndex is installed. export AGENTICDOME PLATFORM="llamaindex" export AGENTICDOME LLAMAINDEX AGENT ID="support llamaindex agent" export AGENTICDOME SANITIZE QUERY OUTPUT="true" export AGENTICDOME SANITIZE TOOL OUTPUT="true" export AGENTICDOME HANDOFF TOKEN TTL S="900" Optional for distributed multi-worker handoff verification: export AGENTICDOME REDIS URL="redis://localhost:6379/0" export AGENTICDOME REDIS KEY PREFIX="AgenticDome:llamaindex:handoff" Notes: wrap tools, query calls, query engines, retrievers, node postprocessors, callbacks, or output boundaries — env config alone does not intercept. LlamaIndex has many integrations and provider-native tool specs; remote services outside your process must be protected at their request/response boundary. Place wrappers in the module where components are assembled, not only inside request handlers. Use stable session id values, and set AGENTICDOME REQUIRE SESSION ID=true when every query/tool call must be traceable. from agenticdome sdk.llamaindex import AgenticDomeLlamaIndexFirewall, DecisionTokenRecord, DecisionTokenStore, FirewallConfig, InMemoryDecisionTokenStore, RedisDecisionTokenStore, For services that call Bedrock Runtime directly, stream model responses, invoke Bedrock Agents, implement action-group Lambda handlers, execute local tool-use results, or process knowledge-base retrieval. The adapter accepts any boto3-compatible client and does not import boto3 at module import time, so tests and custom clients use the same wrapper. pip install "agenticdome-python-sdk bedrock " Secure Converse — the flow is messages/system → prompt screen → Bedrock Converse → output review → sanitized response : python import boto3 from agenticdome sdk.aws bedrock import AgenticDomeAWSBedrockFirewall bedrock = boto3.client "bedrock-runtime", region name="us-east-1" firewall = AgenticDomeAWSBedrockFirewall response = await firewall.converse securely bedrock runtime client=bedrock, model id="anthropic.claude-3-5-sonnet-20241022-v2:0", messages= { "role": "user", "content": {"text": "Summarize this customer case."} , } , agent id="support bedrock agent", session id="sess prod 01J4X", Streaming Converse: async for event in firewall.converse stream securely bedrock runtime client=bedrock, model id="anthropic.claude-3-5-sonnet-20241022-v2:0", messages=messages, agent id="support bedrock agent", session id="sess prod 01J4X", : yield event Secure InvokeModel — for provider-specific payloads Titan, Claude, Llama, Mistral, or other model-native bodies : python import json response = await firewall.invoke model securely bedrock runtime client=bedrock, model id="amazon.titan-text-express-v1", body=json.dumps {"inputText": "Draft a customer email."} , agent id="support bedrock agent", session id="sess prod 01J4X", contentType="application/json", accept="application/json", Streamed provider-native responses: async for event in firewall.invoke model with response stream securely bedrock runtime client=bedrock, model id="amazon.titan-text-express-v1", body=json.dumps {"inputText": "Draft a customer email."} , agent id="support bedrock agent", session id="sess prod 01J4X", : yield event The adapter extracts prompt text from common payload shapes inputText , prompt , messages , contents , system , Claude anthropic version messages, Llama/Mistral prompts, provider-native JSON bodies and writes sanitized text back into common response fields outputText , completion , generation , answer , text , generated text , Converse output.message.content .text . Bedrock Agents and action groups: