Agent Nebula SDK
Agent Nebula SDK is a Python security library that provides reusable OAuth, JOSE, token-validation, and sender-constrained authentication components for agent applications. It supplies security primitives and integration contracts; it does not operate the hosted Agent Nebula Registry, OAuth server, or policy service.
The SDK is used by Agent Nebula Platform, which integrates these capabilities with the official A2A Python SDK. Developers building agents can use SecureAgent as the higher-level interface.
Why use the SDK?
- Standards-based security: reusable OAuth and JOSE implementations instead of application-specific token and proof validation.
- Separation of responsibilities: client, authorization-server, and resource-server facades with application-supplied persistence and policy decisions.
- Sender-constrained requests: DPoP proof validation, token binding, replay checks, and resource targeting.
- Protocol integration: HTTP security components for A2A and MCP authorization profiles; the SDK does not implement A2A or MCP message transport.
- Composable infrastructure: ports and adapters for storage, key management, and HTTP interactions.
Security capabilities
| Capability | Standard or interface |
|---|---|
| JWK, JWKS, key thumbprints | RFC 7517, RFC 7638 |
| JWT client authentication | RFC 7523 |
| Dynamic client registration and management | RFC 7591, RFC 7592 |
| Authorization-server and protected-resource metadata | RFC 8414, RFC 9728 |
| Resource indicators | RFC 8707 |
| JWT access tokens | RFC 9068 |
| Demonstrating proof of possession | RFC 9449 (DPoP) |
| A2A and MCP security | HTTP authentication/authorization integration |
For implementation details, constraints, and conformance references, see standards mapping, security model, and documentation index. Additional protocol modules in the source tree should not be assumed to constitute a complete hosted service.
Install
Requires Python 3.12.
pip install agent-nebula-sdk
To develop from source:
uv sync --group dev
make verify
Architecture and integrations
The SDK implements security primitives and exposes contracts for application-owned persistence, credential storage, and authorization decisions. Architecture · Public API · Ports and adapters · Agent Nebula integration.
Documentation
Start with the documentation index. It links to architecture, API facades, OAuth standards, authentication flows, configuration, testing, and integration guidance.
License
Apache License 2.0. See LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for agent-nebula-sdk 5.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| agent_nebula_sdk-5.0.1.tar.gz | 181.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agent_nebula_sdk-5.0.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 368.0 kB
Release files / agent_nebula_sdk-5.0.1.tar.gz
| Download URL | agent_nebula_sdk-5.0.1.tar.gz |
|---|---|
| Size | 181.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
31aa6241c9912368837663faa8b3d31e2686a937d626aaa93136ffa2e9646034
|
|
BLAKE2b-256 checksum How to use checksums |
145d7c14fbbb80999d18e2acddd3987d165f056c881e8cf6d0ba4baf9f7cbd2d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logRelease files / agent_nebula_sdk-5.0.1-py3-none-any.whl
| Download URL | agent_nebula_sdk-5.0.1-py3-none-any.whl |
|---|---|
| Size | 186.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
64b860c26e47dd6fa3dd9e99dc2c018b843a3510fc4b7b985d3c021af6a99c76
|
|
BLAKE2b-256 checksum How to use checksums |
366318a1ffd3fe33a1f9d52a7710d0bd952c9acb021b3481446824af45ce8542
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logSecurity for agent-nebula-sdk 5.0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for agent_nebula_sdk-5.0.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
