ory-langchain

Ory Agent Security for LangChain / LangGraph.

Adds three things to a LangChain agent with one line:

1. Authorization — every tool call is checked against Ory Permissions before it runs.
2. Activity auditing — every invocation is recorded in the unified privacy-safe NDJSON log.
3. Identity propagation — user → agent → sub-agent delegation, recorded in Ory.

Install

pip install ory-langchain

Use

from langchain.agents import create_agent
from ory_langchain import OryMiddleware

agent = create_agent(
    model,
    tools=[search, send_email],
    middleware=[OryMiddleware()],   # gate every tool call through Ory
)

OryMiddleware() reads the shared Ory config at ~/.config/ory-agent-plugins/config.json, so a login performed by any Ory coding-agent harness — or by ory-argus login — is reused transparently. Configure a project explicitly with OryMiddleware(project_url=...).

Permission mode

• observe (default) — denied tools still run, but a permission.observe_deny activity event is recorded. Use this to see what would be blocked before enforcing.
• enforce — denied tools are blocked: the model receives an error ToolMessage and the tool never executes. The posture is read from the Ory project — an admin promotes it to enforce in the Ory Console (Agent Security); ory-argus permissions shows what this machine resolves.

Activity only

If you only want lifecycle activity (no enforcement), use the callback handler instead:

from ory_langchain import OryCallbackHandler

agent.invoke({"messages": [...]}, config={"callbacks": [OryCallbackHandler()]})

Built on ory-argus, the shared Ory Agent Security core.