tenuo-cloud 0.2.0b2

Python SDK for [Tenuo Cloud](https://cloud.tenuo.ai) - managed approval workflows, audit logging, and policy enforcement for warrant-authorized tool calls.

tenuo-cloud

Python SDK for Tenuo Cloud - managed approval workflows, audit logging, and policy enforcement for warrant-authorized tool calls.

tenuo-cloud sits on top of the open-source tenuo core SDK and adds:

• Cloud-hosted approval gates - create requests, poll for resolution, receive SignedApproval objects automatically
• Framework adapters - drop-in support for Temporal, LangGraph, and MCP
• HTTP client - typed sync/async client for the Tenuo Cloud REST API
• Policy-driven approvers - fetch trusted approver keys from your Tenuo Cloud policy

Installation

Published to PyPI as a proprietary, compiled wheel. During beta, pass --pre:

pip install --pre "tenuo[cloud]>=0.2.0"          # recommended once tenuo core ships the cloud extra
pip install --pre "tenuo-cloud>=0.2.0"           # direct install (works today)
pip install --pre "tenuo-cloud[temporal]"        # + Temporal integration
pip install --pre "tenuo-cloud[langgraph]"       # + LangGraph integration
pip install --pre "tenuo-cloud[fastmcp]"         # + MCP / FastMCP integration

Until tenuo[cloud] lands in the open-source tenuo package, use tenuo-cloud directly. See docs/TENUO_CORE_INTEGRATION.md for the core extra wiring.

Tenuo contributors can still install editable source from this monorepo:

pip install -e "sdk/python[dev]"

Quick start

Temporal

# Worker: change the import - nothing else
from tenuo.temporal import TenuoTemporalPlugin
from tenuo_cloud.temporal import TenuoPluginConfig  # cloud-aware drop-in

plugin = TenuoTemporalPlugin(
    TenuoPluginConfig.from_env(activity_fns=activities)
)
client = await Client.connect("localhost:7233", plugins=[plugin])

from_env() reads TENUO_ISSUER_KEY, derives trusted_roots automatically, and - when TENUO_API_KEY is set - wires the cloud approval handler and control plane with no extra config.

LangGraph

# Change the import - nothing else
from tenuo_cloud.langgraph import TenuoMiddleware

agent = create_react_agent(
    ChatOpenAI(model="gpt-4.1"),
    tools=[my_tool],
    middleware=[TenuoMiddleware()],
)

MCP

# Change the import - nothing else
from tenuo_cloud.mcp import SecureMCPClient

async with SecureMCPClient("python", ["server.py"]) as client:
    result = await client.call_tool("transfer", {"amount": 5000})

Standalone (any framework)

from tenuo import guard
from tenuo_cloud import cloud_approval

handler = cloud_approval(
    api_key=os.environ["TENUO_API_KEY"],
    signing_key=holder_signing_key,  # or rely on key_scope() when bound
)

@guard(tool="transfer", approval_handler=handler)
def transfer(amount: int, to: str): ...

Quick Connect

from tenuo_cloud import connect, doctor

report = doctor()          # checks config, Cloud reachability, auth, and claim readiness
report.raise_for_error()   # fail fast in setup scripts

client = connect(verify=True)  # reads TENUO_CONNECT_TOKEN and returns a ready API client

Staging smoke test

export TENUO_API_KEY=tc_...
python scripts/staging_approval_smoke.py

Closed wheel build

The customer-distributed tenuo-cloud package is built as a compiled, platform-specific wheel. The public tenuo_cloud/__init__.py shim and py.typed marker are included, while implementation modules are compiled into native extensions.

python -m pip install -e ".[closed-build]"
python scripts/build_closed_wheel.py --out-dir dist/closed
python scripts/check_closed_wheel.py dist/closed/*.whl

Environment variables

Variable	Required	Description
TENUO_API_KEY	Yes	API key (tc_...) from the Tenuo Cloud dashboard
TENUO_ISSUER_KEY	Worker	Hex-encoded Ed25519 signing key; from_env() reads this to derive trusted_roots automatically
TENUO_CONTROL_PLANE_URL	No	Control plane URL (default: https://api.tenuo.ai). No /v1 suffix needed - the SDK normalizes automatically.
TENUO_DASHBOARD_URL	No	Dashboard URL for approval links (default: https://cloud.tenuo.ai)
TENUO_APPROVAL_TIMEOUT	No	Seconds to wait for human approval (default: 900)
TENUO_TRUSTED_ROOTS	Server-side	Space-separated hex Ed25519 public keys of trusted warrant issuers

Modules

Module	Entry point	Description
tenuo_cloud	cloud_approval, async_cloud_approval	Framework-agnostic approval handlers
tenuo_cloud.temporal	TenuoPluginConfig (drop-in), TenuoPlugin (re-export)	Drop-in config with auto-wired cloud fields
tenuo_cloud.langgraph	TenuoMiddleware (drop-in), TenuoToolNode (drop-in), langgraph_cloud_approval	Drop-in middleware with auto-wired cloud approvals
tenuo_cloud.mcp	SecureMCPClient, CloudMCPApprovalClient, with_cloud_approval	Drop-in MCP client with automatic approval resolution
tenuo_cloud.client	TenuoCloudClient, AsyncTenuoCloudClient	Typed HTTP client for the REST API
tenuo_cloud.exceptions	TenuoCloudError, AuthenticationError, ApprovalDeniedError, ...	Structured error hierarchy

With vs. without tenuo-cloud

You can always use the open-source tenuo core SDK directly and call the Tenuo Cloud REST API yourself. tenuo-cloud eliminates the boilerplate:

Concern	Core SDK only	With tenuo-cloud
Approval handler	~40 lines: POST request, poll loop, hex/base64 parsing	cloud_approval(api_key=...) - one call
Temporal worker	Manual: handler, ControlPlaneClient wiring	Change the import: from tenuo_cloud.temporal import TenuoPluginConfig
MCP client	Catch -32002, extract hash, POST, poll, re-submit	Change the import: from tenuo_cloud.mcp import SecureMCPClient
LangGraph	Implement async handler, manage httpx lifecycle	Change the import: from tenuo_cloud.langgraph import TenuoMiddleware
URL handling	Must include /v1 in all API paths	Auto-normalized; https://api.tenuo.ai works
401 errors	Raw HTTP error	AuthenticationError naming TENUO_API_KEY
Unreachable API	Raw httpx traceback	TenuoCloudError naming the URL

Documentation

• Quickstart
• Migrate in 30 seconds (Temporal)
• LangGraph Tutorial
• Temporal Tutorial
• MCP Integration
• Approvals
• API Reference

License

Proprietary - see LICENSE. The open-source tenuo core SDK is licensed separately.