measure-sdk
The single shared library of the Measure MCP ecosystem.
Every Measure MCP product (measure-analytics-mcp, measure-paid-media-mcp, …)
depends on this package and only this package. It carries the common domain
model and infrastructure so the products never duplicate either.
from measure_sdk import AuditFinding, Report, HealthScore, CostEstimate, Severity
from measure_sdk.infra import PermissionPolicy, get_logger
from measure_sdk.mcp import build_server, ServerContext, tool_errors
Two layers
measure_sdk.domain — shared domain model
Canonical, reusable models and enums every MCP consumes instead of redefining:
| Group | Symbols |
|---|---|
| Findings & reports | AuditFinding (alias Finding), Issue, Recommendation, Report (alias AuditReport) |
| Health | HealthScore, HealthCheck, Grade, compute_health_score, score_from_findings, grade_for |
| Cost & validation | CostEstimate, ValidationResult |
| Alerts | Alert, AlertType, Comparator, Channel, ChannelType, Condition |
| Execution | ExecutionPlan, PlannedChange, ChangeAction |
| Resources | Connection, Entity, Metric, PlatformResource |
| Enums | Severity, Priority, Category |
The Health Score is a standard 0-100 measure (from_checks weighted average
or from_findings penalty model) so platform health is comparable across MCPs.
measure_sdk.infra — shared infrastructure
| Module | Responsibility |
|---|---|
infra.config |
Typed settings from env / .env (Pydantic Settings). |
infra.logging |
Structured logging (console or JSON). |
infra.errors |
Exception hierarchy mapped to MCP tool errors. |
infra.auth |
OAuth-first credential resolution (ADC / service account / OAuth) + scopes, session, discovery. |
infra.permissions |
Read-only-by-default policy and write-confirmation gating. |
infra.cost_control |
Reusable cost-guardrail policy and byte humaniser. |
infra.audit |
Append-only audit log of every privileged action. |
infra.google |
Lazily-constructed, cached Google API clients. |
Plus measure_sdk.mcp (build_server, ServerContext, tool_errors, and the
shared auth tools measure_login / auth_status / auth_doctor every server
inherits), measure_sdk.adapters (OpenAI / Gemini ↔ MCP translation) and
measure_sdk.cli (the measure login / measure doctor command).
Nothing here ever persists credentials — secrets are resolved at runtime and held only in memory.
Authentication
Users sign in with their own Google account via the installed-app OAuth flow —
from inside the assistant (measure_login) or the CLI (measure login). See
docs/authentication.md for the full setup
(create the OAuth client, consent screen, test users, scaling).
1 maintainer
Metadata
1 maintainer
Release files for measure-sdk 0.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| measure_sdk-0.2.1.tar.gz | 57.3 kB | With provenance | Details for measure_sdk-0.2.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| measure_sdk-0.2.1-py3-none-any.whl | Python 3 | none | any | Details for measure_sdk-0.2.1-py3-none-any.whl |
Total release size: 119.0 kB
Release files / measure_sdk-0.2.1.tar.gz
| Download URL | measure_sdk-0.2.1.tar.gz |
|---|---|
| Size | 57.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
557611405cf0770272bbbe4b724b0e6189eafb1177e3d70673402529afc0a5c3
|
|
BLAKE2b-256 checksum How to use checksums |
a4cb3ef5e5904c2bbb84abe4c4fff291c19fc95405e67bb96c8141b3c88e6712
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 7, 2026.
Transparency logRelease files / measure_sdk-0.2.1-py3-none-any.whl
| Download URL | measure_sdk-0.2.1-py3-none-any.whl |
|---|---|
| Size | 61.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ec089978a450a3427acbec8e43310d9a379665e00bfa45a0107ba268440d2da1
|
|
BLAKE2b-256 checksum How to use checksums |
e01bc0339d1ebab2713e8bd96f1375945817b692783912a0d38c14c706c9e628
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 7, 2026.
Transparency logSecurity for measure-sdk 0.2.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for measure_sdk-0.2.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 7, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
