maf-sandbox-bicep
Experimental. Releases before 1.0 may change or remove APIs. Importing this package emits
MafSandboxBicepExperimentalWarning.
Compile and lint Bicep templates and parameter files from an agent's file store. The bicep_validate tool returns compiler diagnostics and fixed guidance about how to use them.
This is an independent package for Microsoft Agent Framework. It uses the maf-sandbox protocol and has no backend dependency.
Quickstart
pip install maf-sandbox-bicep
from maf_sandbox_bicep import make_bicep_tools
tools = make_bicep_tools(
router,
file_store,
"devops-engineer",
context,
image="bicep-sandbox:0.46.1",
)
The host supplies router, file_store and CallerContext. The context lists the files this caller may share. With no router or no configured backend, the factory returns []. An incompatible backend is refused before attachment.
Build the Bicep image and follow the ACAS sample, WSLC sample or Docker sample for complete wiring.
Validation
The tool reads only requested names from the caller's listing. It stages all selected files before compiling, so local modules and parameter-file references resolve together.
Templates use bicep build; parameter files use bicep build-params. The tool also runs lint as applicable. Commands are fixed templates with validated paths. Model text is passed as file content.
The image supplies the CLI and bicepconfig.json at /maf-sandbox/work. The compiler finds that configuration by walking up from the source. Each call uses a fresh child directory for sources, generated files, HOME, TMPDIR and the module cache.
exec_timeout_seconds defaults to 120 per compiler command. Cancellation waits for the bounded active command before cleanup. A cancelled host wait alone does not prove that the guest stopped.
Network access
The default Egress.ALLOWLIST permits public module restore through these fixed destinations:
| Destination | Purpose |
|---|---|
mcr.microsoft.com |
Module manifests |
*.data.mcr.microsoft.com |
Module layers |
aka.ms |
Module-index redirect |
live-data.bicep.azure.com |
Module-index data |
The factory does not widen that list. A Docker or WSLC backend needs its filtering proxy configured to serve it.
Pass egress=Egress.CLOSED for offline validation. This adds --no-restore; local modules work, while unavailable external modules leave validation incomplete. A host may explicitly select UNRESTRICTED only with a backend that supports it.
The allowlist grants no Azure Resource Manager access and supplies no credentials.
Results and cleanup
This version requires maf-sandbox>=0.42.0,<0.43. bicep_validate returns SandboxResult, which the attached tool renders as a list[Content]: completion, an optional valid or invalid verdict, any trusted refusals, any untrusted diagnostics or file-listing hints, then fixed guidance. The item count varies. Incomplete calls have no verdict, and either output sequence may be empty.
Completion, verdict and refusals carry trusted integrity. Diagnostics retain untrusted integrity even with trusted inputs. The host supplies result confidentiality; fixed guidance remains trusted/public. When middleware hides diagnostics, the model reads the verdict or reports the files as unvalidated if there is none. Refused names, staging failures, timeouts, unreadable SARIF and failed module restores leave the call incomplete.
A restore failure reports MODULE RESTORE FAILED. Hidden, empty or unreadable diagnostics do not establish a successful validation. Forwarding hidden diagnostics to a file writer remains subject to that tool's policy.
Diagnostic formatting removes call-directory paths and applies permitted display names. It does not remove arbitrary compiler prose or every external URL.
Direct invoke(..., skip_parsing=True) callers must read each item's .text without assuming fixed indexes. Preserve the items and labels; do not turn the list into a Python string representation. Framework function-result content exposes .items and joins their text in .result.
Core disposes after each call by default. Explicit host opt-in can permit reclaim on a supporting backend. The kind's confinement declaration describes its file placement; it does not certify that a reused sandbox is clean.
See the Bicep guide for the full contract and information flow for labels.
Maintained by SOKOLAI BV.
1 maintainer
Release files for maf-sandbox-bicep 0.19.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| maf_sandbox_bicep-0.19.0.tar.gz | 24.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| maf_sandbox_bicep-0.19.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 51.4 kB
Release files / maf_sandbox_bicep-0.19.0.tar.gz
| Download URL | maf_sandbox_bicep-0.19.0.tar.gz |
|---|---|
| Size | 24.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f5c41054f0f86912f106b76160f2de93b0b3ee89f46df4acb91293b8149445f7
|
|
BLAKE2b-256 checksum How to use checksums |
21f82f550eafc3c777914fee97039a832cbb12bda9187f2b2f3db973a84af713
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.
Transparency logRelease files / maf_sandbox_bicep-0.19.0-py3-none-any.whl
| Download URL | maf_sandbox_bicep-0.19.0-py3-none-any.whl |
|---|---|
| Size | 26.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4d3a5faee07d88b0146699a8faafd6c96a5fe6436db0132198cc40bde4d2369e
|
|
BLAKE2b-256 checksum How to use checksums |
4d2dd48ba6cf9c92b21ffb5134c323ca910a0945a9e3e8a0e9c2ffc2daa0d403
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 21, 2026.
Transparency log
