langchain-relayshield 0.1.0

LangChain tools and a mandatory pre-execution gate for RelayShield's MCP registry risk and prompt-injection breach checks.

langchain-relayshield

LangChain tools and a mandatory pre-execution gate for RelayShield's agentic-security endpoints — MCP server registry risk and AI-agent-sourced credential breach detection.

Install

pip install langchain-relayshield

The mandatory-gate middleware needs LangChain's agent runtime; install the extra if you want it:

pip install "langchain-relayshield[middleware]"

Tools

from langchain_relayshield import check_mcp_server_risk, check_prompt_injection_breach

result = check_mcp_server_risk.invoke({
    "api_key": "rs_live_...",
    "server_url": "https://mcp.example.com/sse",
})

• check_mcp_server_risk — flags known-malicious IOC matches, typosquat domains, and newly-registered domains hosting an MCP server, before an agent connects to or installs it.
• check_prompt_injection_breach — checks whether an email appears in RelayShield's stolen-session corpus with a suspected-agentic-source marker (a session/token exposure that shows signs of having been captured via a compromised AI agent).

Get a key at api.relayshield.net/developers.

Mandatory gate middleware

Most "AI agent security" checks are optional — the agent can call them, but nothing stops it skipping the call and taking the risky action anyway. RelayShieldMCPGateMiddleware is the other kind: a gate the agent's framework enforces before a protected action (connecting to or installing an MCP server) can happen at all.

from langchain_relayshield.middleware import RelayShieldMCPGateMiddleware

agent = create_agent(
    model=...,
    tools=[...],
    middleware=[RelayShieldMCPGateMiddleware()],
)

Properties, all non-negotiable by design:

• A hook exception defaults to defer, never silently to allow.
• Bounded retry applies only to transient upstream failures (timeout/429/5xx) — auth failures, malformed responses, and payment-required states are terminal after one attempt.
• The audit log records decision, reason codes, check version, target, and timestamp — never keys, payment proofs, or session material.
• The raw connect/install tool should never be bound to the model directly — only a composite tool that routes through this gate.

Full design writeup and a 12-case protected-action acceptance suite: relayshield-langchain-gate (this middleware's original standalone reference implementation, now also packaged here).

License

MIT