agent-custody (Python)
Signed, verifiable receipts for AI agent tool calls, from Python. The key, the Cedar policy, and the Merkle log live in the agent-custody sidecar, a local process from the npm package; this client talks to it over HTTP with the standard library only.
npm install -g @agent-custody/receipts && agent-custody keygen --dir keys --name app
agent-custody serve --config sdk.json # loopback, port 8788
pip install agent-custody
from agent_custody import Client, PolicyDeniedError
client = Client() # http://127.0.0.1:8788/
refund = client.wrap("stripe.refund", lambda args: stripe.refund(**args))
refund({"amount": 5000}) # decide, run, record; raises PolicyDeniedError on deny
Adapters, each tested against the real package: agent_custody.langchain.ReceiptCallbackHandler (record-only), agent_custody.crewai.wrap_tools (enforce: each CrewAI tool becomes a CustodyTool with the same name, description, and schema whose run is decided, executed, and recorded; a denial is returned as the tool result), agent_custody.openai_agents.wrap_tools (enforce and record), agent_custody.claude_agent_sdk.claude_hook (PreToolUse deny, PostToolUse record), agent_custody.hermes (a Hermes Agent plugin: pre_tool_call block, post_tool_call record; the drop-in plugin directory is hermes-plugin), agent_custody.adk.adk_callbacks (Google ADK: before_tool_callback skips a denied tool and hands the model the receipt, after_tool_callback records; LlmAgent(..., **adk_callbacks(client)); extra adk, which installs google-adk[a2a]). Receipts are verified by the TypeScript verifier; the tests do exactly that. An ADK agent's delegations to other agents over A2A are not tool calls and pass no callback; the gateway's A2A front, agent-custody gateway --a2a, covers them, and tests/test_adk_a2a.py runs ADK's own RemoteA2aAgent through it.
The memory tools. agent_custody.memory.MemoryClient (extra memory) talks to the shared memory server from @agent-custody/state over MCP: write, read, retract, history. Writes from here are claimed, quarantined until a gateway confirms them, and reads leave quarantined facts out unless asked; that is the honest position of an agent that did not go through the gateway.
async with MemoryClient("http://127.0.0.1:8790/mcp", token=os.environ["MEMORY_DIRECT_TOKEN"]) as memory:
await memory.write("acct:42", "plan", "pro", space="team:support", actor="py-agent")
await memory.read(subject="acct:42", include_claimed=True)
Everything recorded is claimed: the sidecar trusts what this process reports, the same as the in-process TypeScript SDK. For enforcement the agent cannot skip, put the gateway in front of the tools instead; it is an MCP server and needs nothing from this package.
uv run --extra test pytest # from packages/python; starts a sidecar with node from ../receipts
1 maintainer
Metadata
1 maintainer
Release files for agent-custody 0.10.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| agent_custody-0.10.0.tar.gz | 391.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agent_custody-0.10.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 405.5 kB
Release files / agent_custody-0.10.0.tar.gz
| Download URL | agent_custody-0.10.0.tar.gz |
|---|---|
| Size | 391.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ee4faf07499e4c63f72bf62bc26d916958c3689e245c871cea1fad288b56e783
|
|
BLAKE2b-256 checksum How to use checksums |
364762e131831638232cec864861d8585c74c14099e36a90aac555747af01f03
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logRelease files / agent_custody-0.10.0-py3-none-any.whl
| Download URL | agent_custody-0.10.0-py3-none-any.whl |
|---|---|
| Size | 14.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c16f85ff13d905e7e988abf5440e6cd1e45e6e56171e151e06b2da8466196f56
|
|
BLAKE2b-256 checksum How to use checksums |
c97ce4640f9c6e0b1f3ee85e32726833da1cfb949b63c0bd32f32beb37fda892
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logSecurity for agent-custody 0.10.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for agent_custody-0.10.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
