Release list

Latest

deghosal-2026 released this 15 Aug 10:40

v0.2.0

95adfc6

Agent ToolTrust v0.2.0 Release Notes

Status: Released ✅
Package: agent-tooltrust · Version: 0.2.0
Released: 2026-08-15
Related: WBS v0.2.0 · decisions-v0.2.0 · Field Test Report · Migration Guide · CHANGELOG

Highlights

Agent ToolTrust v0.2.0 ships a fleet-ready, auditable, hardened policy decision point. The core engine is unchanged and battle-tested; everything around it — audit, observability, security posture, and service surfaces — grew substantially.

Fleet & PDP — HTTP POST /authorize for non-Python hosts, MCP-Data connector for per-data-source authorization, OPAL distributed policy sync, and a community policy-pack catalog.
Audit & observability — session replay, session-to-session analytics, score calibration, argument redaction, stale-credential tagging, and write-time tamper-evident hash chaining.
Security & compliance — OWASP Agentic AI Top 10 10/10, ToolTrust Hardened baseline 15/15 checks, OpenSSF path-to-Gold documented.
Quality gate — 1068+ tests, 91% coverage, ruff + mypy --strict clean, field test Plan A 83/83 (100%), deterministic engine matrix 2490/2490 (100%).

What's new

Fleet & PDP (M6)

HTTP /authorize endpoint — language-agnostic PDP: post a JSON tool call and get a Decision back (F-43). Ideal for Go/JS/Java callers and gateways.
MCP-Data connector — tooltrust.authorize_data_source MCP tool and mcp_data module authorize per data source (mcp_data.<source_id> taxonomy registration).
OPAL distributed policy sync — Engine.reload_policy(), integrations/opal.py client, and tooltrust policy rollback --version <v>.
Policy packs catalog — packs/ catalog with 5 seed packs (db-queries, fs-basics, shell-safe, cloud-read, http-crud); tool pack list / pack info.
Fleet deployment guide — topology, nginx LB, docker compose, OPAL sync, rollback, monitoring.

Audit & Observability (M5)

Session replay from audit — audit session --replay <id> reconstructs cumulative risk identically to live use (shared session_risk_increment).
Session-to-session analytics — recurring benign denials, deny→allow transitions, dead/over-hit rules (analytics sessions + /api/analytics/sessions).
Score calibration & shadow mode — counterfactual thresholds, false-allow/escalate rates by tool/env/data-class (calibrate report + /api/analytics/calibration).
Audit argument redaction — token, password, apiKey, authorization, secret, … redacted by default; redacted: true flag; nested dict/list coverage.
Stale-credential classification — credential_status tag distinguishes engine-allow-but-credential-rejected calls from not-available.
Write-time tamper-evident chain — JSONL/SQLite/Postgres persist chain_hash/prev_hash; audit verify fails loudly on tampered/missing entries.

Security & Compliance (M7)

ToolTrust Hardened baseline — baseline check hardened → 15/15 PASS (fail-closed, adversarial normalization, deny rules, tamper chain, redaction, session analytics, delegation, escalation, output inspector, OTel, deny-storm detection, argument policy).
OWASP Agentic AI Top 10 — 10/10 covered (up from 5/10 in v0.1.0).
OpenSSF Scorecard — 12/14 Gold criteria met, path to Gold documented.

Threat & Anomaly (M4)

Deny-storm / probe detection — session-level analyzer; throttle/lock/pause.
URL fetch category guard — robots.txt, PII strip, SSRF redirect re-resolution.
External verification sink — agent-unwritable ground truth vs self-report.

Breaking changes & migration

No breaking API changes. The in-process Engine.evaluate() API, adapters, and policy format are unchanged. See Migration Guide for:

Decision and AuditEntry gained read-only fields (counterfactual, arguments, redacted, credential_status, chain_hash/prev_hash).
Audit sinks now persist tamper-evident chain fields at write time.
Audit redaction is on by default (sensitive arg keys → ***REDACTED***).

Quality gates

Gate	Result
Unit + integration tests	1068+ passed
Test coverage	91% (threshold 90%)
Ruff (strict)	clean
mypy --strict	clean (100 source files)
Field test — Plan A	83/83 (100%) across 10 frameworks
Field test — Plan B	116/123 (94%) (tier-1 LLM tool-selection limit, accepted — see report)
Replan sweep	8/8 live, 8/8 scripted
Deterministic engine matrix	2490/2490 (100%)
Docker console	`docker compose up --wait` green

Field test summary

Plan A (one scenario per agent) passes 100% for all 10 frameworks. Plan B proves every framework surfaces allow/audit/escalate/deny; the only misses are 7 tier-1 rows where the LLM picked the wrong tool when 5 tools share near-identical names — an LLM tool-selection limit, not an engine defect. Full findings, model comparison (gpt-oss-20b vs deepseek-v4-flash vs glm-5 vs local Qwen), observations, and lessons in the Field Test Report.

Known limitations / deferred (post-0.2)

Tier-1 multi-tool field-test pattern is unreliable with current LLMs; recommended to drop or convert to Plan A style.
Deny-storm active enforcement and verification-sink adapters finalized.
Policy-analytics auto-mutation deferred (human approves suggestions).
Fleet-scale performance validated only to the 3-instance OPAL test.
smolagents cloud (OpenRouter) interop caveat documented; local OMLX path verified.

Thanks for using Agent ToolTrust.

Assets 2

Agent ToolTrust v0.1.1

deghosal-2026 released this 13 Aug 05:36

v0.1.1

8b05311

Agent ToolTrust v0.1.0 Release Notes

Released: 2026-08-13
Package: agent-tooltrust · Version: 0.1.0
License: MIT

Agent ToolTrust is a deterministic policy decision point for tool-using AI
agents. It scores every tool invocation across five risk dimensions and returns
one of four decisions — allow, audit, escalate, deny — with a fully
explainable, auditable, fail-closed policy. This is the first stable release.

What shipped

The decision pipeline

 Tool Call → NORMALIZE → SCORE → DECIDE → EXPLAIN → AUDIT

Every call produces a complete Decision (verdict, criticality, reason code,
human explanation, risk factors, escalation id). Any stage that fails closes to
a deny — never an exception surfacing, and never a silent allow.

Decision	Meaning	Example
Allow	Execute normally	read of internal data in staging
Audit	Allow + enhanced logging	delete in staging by a trusted agent
Escalate	Human approval required	write/deploy in production
Deny	Blocked with reason	delete in production, PII access

Integration options

Raw Python — @engine.guard decorator + session context manager.
Framework adapters — LangGraph, PydanticAI, OpenAI Agents SDK, CrewAI,
AutoGen, LlamaIndex, SmolAgents, Google ADK.
MCP — an MCP server exposing evaluate, explain, and
session_status (SSE transport); plus a client wrapper for MCP
tools/call proxying.
Docker — containerized server with health endpoint and SSE integration
tests (docker compose up).

Security posture

Adversarial normalization (F-89 P0): NFKC + case-fold + confusable
transliteration blocks Unicode / homoglyph tool-name obfuscation.
Fail-closed by default: unknown tool, blank input, or malformed call →
deny.
Shadow / dry-run mode to preview policy without blocking.
Policy presets: balanced / strict / permissive, YAML tooltrust.yaml,
OPA/Rego backend, hot-reload.
Audit trail: JSONL / SQLite / Postgres sinks with a tamper-evident hash
chain and tooltrust audit CLI.
Governance: OWASP Agentic Top 10 mapping (5/10 covered in v0.1),
security baseline, arg validators (path-traversal, URL), output inspector
(secrets / PII / injection), and tool scanning.

Field validation

83-agent roster across 10 agent frameworks.
Decision matrix: 2,490 assertions, Plan A 83/83 (100% green), plus 100
adversarial assertions.
Model replan round-trip: deny → different tool → allow, with a CI-safe
deterministic (scripted) mode (8/8) and an optional live LLM mode.
SWE-bench integration (tooltrust swebench) replays coding-agent
benchmarks with per-task violation traces.

CLI

tooltrust init --posture balanced
tooltrust evaluate ...        # one-shot decision
tooltrust explain ...         # human-readable reasoning
tooltrust check FILE          # policy check
tooltrust diff A.yaml B.yaml  # policy diff
tooltrust scan TARGET         # tool scanning
tooltrust audit               # audit trail
tooltrust report              # governance reports
tooltrust test                # test runner
tooltrust field-test          # field matrix + replan sweep
tooltrust swebench            # SWE-bench benchmark

See the CLI reference for full usage.

Demo

A runnable demo agent shows the full decision
spectrum in one session — allow → audit → escalate → deny → replan — plus an
adversarial variant that correctly denies prompt injection and Unicode
obfuscation. Run:

python examples/demo-agent/demo.py
python examples/demo-agent/demo_adversarial.py

Quality gates (v0.1.0)

Gate	Result
Unit + integration tests	564 passing
Field test matrix	2,490 / 2,490 passing (100%)
Replan round-trip	8/8 (scripted)
Ruff	0 errors
Mypy (--strict)	0 errors
Test coverage baseline	85% (raised in v0.2)

Known limitations

OWASP Agentic Top 10: 5/10 risks covered in v0.1.0; remaining 5 (arg
validation, rate limiting, output inspection depth, child delegation,
tool hiding) target v0.2+.
OpenSSF Silver / Sigstore / PyPI publish are staged for this release
gate and not yet live.
Live replan field sweep needs a local LLM endpoint (omlx); the
scripted (CI-safe) path is the default.

What's coming in v0.2.0

Remaining OWASP coverage (9/10) and ToolTrust Hardened baseline.
Session/context state, escalation round-trip, tool hiding/hardening.
Distributed policy sync and OpenSSF Silver / Gold aspiration.

Links

Assets 4

Agent ToolTrust v0.1.0

deghosal-2026 released this 13 Aug 05:23

v0.1.0

9a1078f