MAS Framework

Secure multi-agent runtime:

Agents connect over gRPC + mTLS
Server owns all Redis access (routing, state, audit, policy)
Agents never touch Redis

Use Cases

Ship multi-agent systems without widening data access: enforce deny-by-default ACLs and mTLS identity per agent.
Meet security and compliance requirements with tamper-evident audit logs and explicit policy decisions.
Protect sensitive data in transit using DLP scanning with block/redact rules.
Reduce incident blast radius with centralized policy, rate limiting, and circuit breakers.
Support multi-team agent development without shared Redis credentials or direct data access.
Export distributed traces and metrics with OpenTelemetry for operational visibility.

Architecture

Agent (mTLS)  ─┐
Agent (mTLS)  ─┼─→  MAS Server (gRPC + mTLS)
Agent (mTLS)  ─┘        ├─ AuthN: SPIFFE URI SAN (spiffe://mas/agent/{agent_id})
                         ├─ AuthZ: deny-by-default ACL (+ optional RBAC)
                         ├─ DLP scanning (block/redact)
                         ├─ Rate limiting
                         ├─ Circuit breaker + DLQ
                         ├─ Audit log (Redis Streams, tamper-evident)
                         ├─ OpenTelemetry traces + metrics (optional)
                         └─ Redis Streams for durable delivery + Redis hashes for state

Quick Start

Start Redis

redis-server

Create mas.yaml

Use mas.yaml.example as a template. You must provide:

Server cert/key + CA (tls_ca_path, tls_server_cert_path, tls_server_key_path)
A client cert/key per agent (tls_cert_path, tls_key_path)

Implement agents

Runner injects server_addr and tls into your agent constructor; accept **kwargs and pass through.

from __future__ import annotations

from pydantic import BaseModel

from mas import Agent, AgentMessage


class Ping(BaseModel):
    value: int


class EchoAgent(Agent[dict[str, object]]):
    def __init__(self, agent_id: str, **kwargs: object) -> None:
        super().__init__(agent_id, **kwargs)

    @Agent.on("ping", model=Ping)
    async def handle_ping(self, message: AgentMessage, payload: Ping) -> None:
        await message.reply("pong", {"value": payload.value + 1})

uv run python -m mas

Tail audit logs (optional)

uv run mas audit tail --last 10
# or: uv run python -m mas audit tail --last 10

Example

End-to-end mTLS + request/reply:

redis-server
cd examples/e2e_ping_pong
bash make_certs.sh
uv run python -m mas

Development

uv sync
uv run ruff check .
uv run ruff format .
uv run pytest
uv run ty check

Release files for mas-framework 0.4.5

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for mas-framework 0.4.5
File	Size	Uploaded
mas_framework-0.4.5.tar.gz	231.4 kB	Feb 13, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for mas-framework 0.4.5
File	Interpreter	ABI	Platform	Reset
mas_framework-0.4.5-py3-none-any.whl 75.5 kB Feb 13, 2026	Python 3	none	any	Details

Total release size:306.9 kB

Release files / mas_framework-0.4.5.tar.gz

Download URL	mas_framework-0.4.5.tar.gz
Size	231.4 kB
Tags	Source
SHA-256 checksum How to use checksums	`cb762445b3f634f036c6eb2bd605e66dc3fbb624858b10f0f03dc787f1e99756`
BLAKE2b-256 checksum How to use checksums	`174e9d2fc2a232cb4cd6eb47b65943f9765b68a1d6265b3d30d409388d5b5b22`
Upload date	Feb 13, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`uv/0.10.2 {"installer":{"name":"uv","version":"0.10.2","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}`

Release files / mas_framework-0.4.5-py3-none-any.whl

Download URL	mas_framework-0.4.5-py3-none-any.whl
Size	75.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`139cd77337bc1a38fc7d0a17962a20d40e43fe5eb8512772755a5344589357f3`
BLAKE2b-256 checksum How to use checksums	`4c110349fe2109728350ba7dfe792b773f9825ba0069cdf0618b140dd9277bcc`
Upload date	Feb 13, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`uv/0.10.2 {"installer":{"name":"uv","version":"0.10.2","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"24.04","id":"noble","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}`