deny-sh-openai-agents

Wrap a deny.sh vault entry as an OpenAI Agents SDK tool (Python). The credential resolves inside the tool boundary; only a narrowed DTO reaches the model. Fail-closed leak sweep.

pip install deny-sh-openai-agents openai-agents

Usage

import os
import requests
from pydantic import BaseModel
from agents import Agent, Runner
from deny_sh_openai_agents import deny_vault_tool

class InvoiceArgs(BaseModel):
    id: str

def lookup(stripe_key: str, args: dict) -> dict:
    r = requests.get(
        f"https://api.stripe.com/v1/invoices/{args['id']}",
        headers={"Authorization": f"Bearer {stripe_key}"},
    )
    body = r.json()
    # narrowed DTO -- never the raw key, never the raw upstream body
    return {"id": body.get("id"), "amount_due": body.get("amount_due"), "status": body.get("status")}

invoice_tool = deny_vault_tool(
    label="stripe-prod",                  # or: id="item_abc"
    password=os.environ["VAULT_PW"],      # server env, never the prompt
    name="get_invoice",
    description="Look up a Stripe invoice by id",
    args_schema=InvoiceArgs,
    use=lookup,
)

agent = Agent(
    name="Billing",
    instructions="Help the user with their invoices.",
    tools=[invoice_tool],
)

result = Runner.run_sync(agent, "What is the status of invoice in_1?")
print(result.final_output)

The Stripe key is resolved + consumed entirely inside lookup. The agent and the model provider see only the input args and the narrowed return. The key never enters the model's context window. If use ever returns the raw secret, the leak sweep raises (DenyLeakError) and the secret never crosses back into the model context.

Multi-tenant

Pass a per-tenant client_options={"api_key": ...} and password. One tenant cannot decrypt another's vault entry; the boundary is cryptographic, not policy-based.

Config

Apache-2.0. Part of deny-sh-integrations.