🐍 makerchecker (Python SDK)

Governance your Python agent can't skip — one wrapper around every tool call.

A typed HTTP client for a running MakerChecker server, plus the governed_tool wrapper. It opens a proxy session and routes a Python agent's tool calls through the server's deny-by-default grants, segregation of duties, approval gates, and a hash-chained, Ed25519-signed audit. The API mirrors the TypeScript SDK at ../sdk.

PyPI Python License

📦 Install

pip install "makerchecker @ git+https://github.com/sammysltd/makerchecker#subdirectory=packages/sdk-python"

Plain pip install makerchecker from PyPI works from the next tagged release. Python 3.10+. Runtime dependency: httpx.

🚀 Use

from makerchecker import create_client, governed_tool, GovernanceDeniedError

client = create_client("http://localhost:3000", api_key="mk_...")
session = client.proxy.open_session("crew-run")["session"]

ingest = governed_tool(
    client, session["id"], "recon-preparer", "csv-ingest@1",
    lambda i: read_csv(i["path"]),
)

try:
    result = ingest({"path": "statement.csv"})  # checks first; a deny throws before read_csv runs
except GovernanceDeniedError as err:
    print(err.code, err.reason)

client.proxy.close_session(session["id"])

governed_tool calls client.proxy.check, raises GovernanceDeniedError(code, reason) on a deny before fn runs, then runs fn(input), records the output, and returns it. If fn raises, it records {"message": str(err)} and re-raises. skill_ref is a name@version string; a grant for one version does not authorize another.

📖 API

create_client(base_url, api_key=None) -> Client
Client(base_url, api_key=None, *, http=None)   # context manager; close() releases an owned httpx.Client

client.health() -> dict                          # GET  /healthz
client.trigger_flow(name, input=None) -> dict    # POST /api/flows/{name}/runs
client.verify_audit() -> dict                    # GET  /api/audit/verify
client.close() -> None

client.proxy.open_session(label, external_ref=None) -> dict          # {"session": {"id", ...}}
client.proxy.check(session_id, agent_name, skill_ref, input=None) -> CheckResult
client.proxy.record(session_id, check_id, output=..., error=...) -> dict
client.proxy.close_session(session_id) -> dict
client.proxy.get_session(session_id) -> dict

governed_tool(client, session_id, agent_name, skill_ref, fn) -> Callable[[dict], T]

check returns CheckResult(allowed, check_id, code, reason). A deny returns 200 with allowed=False, not an error. record uses sentinel defaults, so output=None records a literal None and differs from omitting output. Any response with status >= 400 raises ApiError(status, body).

CrewAI and LangChain tools are callables: wrap the implementation with governed_tool and call it from the @tool body.

📄 License

Apache-2.0. See LICENSE. The MakerChecker server it talks to is AGPL-3.0.

Project links

Data verified by PyPI on Jul 6, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for sammysltd from gravatar.com sammysltd

Credits

Author: Mashini Investments Ltd.

GitHub Statistics

Data verified by PyPI on Jul 6, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

Apache Software License (Apache-2.0)

Requires

Python >=3.10

Provides Extra

dev

Tags

ai-agents audit crewai governance langchain segregation-of-duties

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

makerchecker-1.2.0.tar.gz (38.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

makerchecker-1.2.0-py3-none-any.whl (10.7 kB view details)

Uploaded Python 3

File details

Details for the file makerchecker-1.2.0.tar.gz.

File metadata

  • Download URL: makerchecker-1.2.0.tar.gz
  • Upload date:
  • Size: 38.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for makerchecker-1.2.0.tar.gz
Algorithm Hash digest
SHA256 b1e0760b938eeeb95691ec8956f9de2f8a5efffbc5667dbdd5214a9d11186372
MD5 aae3c19e765e288cd5ed2fb57ea32ae4
BLAKE2b-256 9ec4acfed4822207123f01fc882658ee4191cf484d61a0dba70004ad5f9753e8

See more details on using hashes here.

Provenance

The following attestation bundles were made for makerchecker-1.2.0.tar.gz:

Publisher: release.yml on makerchecker/MakerChecker

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file makerchecker-1.2.0-py3-none-any.whl.

File metadata

  • Download URL: makerchecker-1.2.0-py3-none-any.whl
  • Upload date:
  • Size: 10.7 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for makerchecker-1.2.0-py3-none-any.whl
Algorithm Hash digest
SHA256 0ff57c8559c4b9cbeb0fbc612f39a68b49b641a0bc49d05c1f06e8b0998a34c2
MD5 737bb3214b0696594a2d173ff9d4fe98
BLAKE2b-256 6ddfe90f239f7e923923605b55cac05eed9e15b18bb01e84135a747f8fe45b3d

See more details on using hashes here.

Provenance

The following attestation bundles were made for makerchecker-1.2.0-py3-none-any.whl:

Publisher: release.yml on makerchecker/MakerChecker

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page