grantex-openai-agents

OpenAI Agents SDK integration for the Grantex delegated authorization protocol — scope-enforced agent tools.

Wrap any function with Grantex grant token verification so your agents can only use tools they've been authorized for.

Homepage | Docs | Sign Up Free | GitHub

Install

pip install grantex-openai-agents

You also need the OpenAI Agents SDK installed (it's a peer dependency):

pip install openai-agents

Quick start

from grantex_openai_agents import create_grantex_tool

# Create a scope-enforced tool from any function
tool = create_grantex_tool(
    name="read_calendar",
    description="Read upcoming calendar events",
    grant_token=grant_token,       # JWT from Grantex authorization flow
    required_scope="calendar:read",
    func=get_calendar_events,      # your function
)

# Use with any OpenAI Agents SDK agent
from agents import Agent
agent = Agent(name="assistant", tools=[tool])

If the verified grant token doesn't include the required scope, create_grantex_tool raises a PermissionError immediately and the tool is never created.

API reference

create_grantex_tool()

Creates an OpenAI Agents SDK FunctionTool with JWKS-backed grant token verification.

get_tool_scopes()

Returns the scopes embedded in a grant token (offline, no network call).

decode_jwt_payload()

Decodes the payload of a JWT without verifying the signature. Useful for inspecting token claims.

Requirements

• Python 3.9+
• grantex >= 0.3.12
• openai-agents >= 0.0.3 (peer dependency)

Grantex Ecosystem

This package is part of the Grantex ecosystem. See also:

• grantex — Core Python SDK
• @grantex/sdk — TypeScript SDK
• grantex-crewai — CrewAI integration
• grantex-adk — Google ADK integration
• @grantex/mcp — MCP server for Claude Desktop / Cursor / Windsurf

License

Apache-2.0

Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: sanjeev@orchestrum.in or mishra.sanjeev@gmail.com.

Authority hardening requires Python SDK 0.7.1 (current_authority), not just a valid JWT signature. Bind the audience and trusted human/agent identities, and check the issuer before every execution. This does not create human consent or automatically consume action decisions/spend caps. Existing offline defaults remain offline. Verify registry availability before installation. See the SDK execution authority guide.