grantex-strands

Strands Agents SDK integration for the Grantex delegated authorization protocol - scope-enforced agent tools.

Wrap Strands tool functions with Grantex grant token scope checks so agents only receive tools they have been authorized to use.

Homepage | Docs | GitHub

Install

Version 0.2.0 is a breaking release requiring Python 3.11+ and grantex 0.7+. Online tools forward audience to client.enforce(). The default verified mode checks signatures and scopes, not current revocation. This helper has no amount extractor; for capped tools call Grantex.enforce(..., amount=...) directly before execution. Do not use caps_mode="warn" or "off" as production spend enforcement. See the migration guide.

pip install grantex-strands==0.2.1 grantex==0.7.1

You also need the Strands Agents SDK installed:

pip install strands-agents

Quick Start

from grantex_strands import create_grantex_tool

def get_calendar_events(date: str = "") -> str:
    return f"events for {date}"

read_calendar = create_grantex_tool(
    name="read_calendar",
    description="Read upcoming calendar events",
    grant_token=grant_token,
    required_scope="calendar:read",
    func=get_calendar_events,
)

# Pass read_calendar into your Strands agent tools list.

If the verified grant token does not include the required scope, create_grantex_tool raises PermissionError immediately and the tool is not created.

Enforcement Modes

Verified mode is the default. It verifies the grant token against JWKS and checks the verified scp claim:

tool = create_grantex_tool(
    name="read_calendar",
    description="Read upcoming calendar events",
    grant_token=grant_token,
    required_scope="calendar:read",
    func=get_calendar_events,
)

Online mode delegates enforcement to a Grantex client:

tool = create_grantex_tool(
    name="read_calendar",
    description="Read upcoming calendar events",
    grant_token=grant_token,
    required_scope="calendar:read",
    func=get_calendar_events,
    client=grantex_client,
    connector="calendar",
    online=True,
)

API Reference

create_grantex_tool()

Creates a Strands-compatible tool with Grantex scope enforcement.

get_tool_scopes()

Returns the scopes embedded in a grant token. Invalid tokens return an empty list.

Requirements

• Python 3.11+
• grantex >= 0.3.12
• strands-agents >= 0.1

Grantex Ecosystem

This package is part of the Grantex ecosystem. See also:

• grantex - Core Python SDK
• grantex-crewai - CrewAI integration
• grantex-openai-agents - OpenAI Agents SDK integration
• grantex-adk - Google ADK integration

License

MIT

Ownership

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: sanjeev@orchestrum.in or mishra.sanjeev@gmail.com.

Authority hardening requires Python SDK 0.7.1 (current_authority), not just a valid JWT signature. Bind the audience and trusted human/agent identities, and check the issuer before every execution. This does not create human consent or automatically consume action decisions/spend caps. Existing offline defaults remain offline. Verify registry availability before installation. See the SDK execution authority guide.