AgentBridge MCP server

AgentBridge

Production target restriction: HTTP named-target execution is disabled for generic MCP/A2A/ACP transports in prod and production until destination-atomic authority/fencing is qualified. Translation and nonproduction synthetic evaluation remain available. See destination contract.

Protocol interoperability and governed execution for AI agents.

AgentBridge is an open-source Python project for translating selected AI-agent tool-call formats and applying controls such as agent identity, authorization, budgets, approvals and audit history. The long-term goal is a portable trust layer that works alongside existing agent frameworks and gateways—not another all-in-one agent platform.

Engineering alpha; production NO-GO. The November 3 recorded main is 44a06c364e348966e0b14c724f14e3a14d192433, the approved PR #85 merge. Its own 16-job core CI run passed. The reviewed source separately passed 24 checks across seven workflows. The bounded worker-lifecycle drill now tests renewal, expiry, stale refusal and signed readback after one lost-ACK effect; it does not qualify physical HA or production recovery. All 16 branches were retained at this snapshot. Earlier consolidation counts describe their dated observations. Actual AWS multi-node traffic, broader physical HA, trusted published releases and external acceptance remain open. See the dated progress checklist. The older evaluator wheel remains separate, unsigned and unpublished. Current source, evidence and open gates · Documentation index · Security policy

Protecting the code and release boundaries

This code is published under Apache 2.0; the existing license grants remain in force. Security-critical changes require review and must not imply certification. See code/IP safeguards, four-product execution criteria, and the security policy. The reconciled R4 engineering work and reviewed fixes are incorporated in main through PR #41. Production acceptance remains open.

Why AgentBridge?

AI-agent frameworks can call tools, but organizations also need to answer:

• Who requested an action, and with which authority?
• Exactly what parameters, target and cost were authorized?
• What happened if the connection dropped after execution?
• What evidence can an independent reviewer actually verify?

The protocol mesh provides a useful starting point. The evolving Trust and Evidence components aim to address the more difficult authorization, ambiguous outcome, reconciliation and auditability questions. Those guarantees remain scope- and destination-dependent, not universal.

At a glance

Capability	Maintained implementation scope	Qualification remaining
Canonical tool-call translation across six adapter families	Limited subset with explicit unsupported-feature rejection	Full protocol lifecycle/version matrix
Agent signatures, budgets, policies and approval controls	Selected paths; opt-in enrolled tenant SDK/HTTP and shared-SQL admission/settlement	Remaining ingress, destination and adversarial qualification
SQLite / PostgreSQL support	Bounded tenant namespaces, offline migration, admission caps, retained-task/event/audit-payload caps and shared tenant stream allocations	Remaining evidence bytes, large-history performance, protected retention, physical connection limits, live migration and HA
Separately signed action receipt + readback verification	Tested in bounded sandbox / PostgreSQL paths	Independent administration and real destination acceptance
Production network isolation, HA and full MCP/A2A conformance	Not qualified	Still not qualified
Native queued tasks	Signed acceptance and atomic admission; private one-shot synthetic dispatch, bounded result and read-only recovery	Public worker/transport, historical-key recovery, acknowledged remote cancellation and production qualification
Enterprise managed service or formal certification	Not available	Not available

Protocol families: MCP, A2A, BeeAI ACP, OpenAI tool calling, Gemini tool calling and AGNTCY ACP. A 6 × 6 basic call translation matrix does not imply all sessions, streaming, async tasks, extensions or current-version transports are interoperable. See protocol details and the review compatibility contract.

Quick start

Requires Python 3.11 or 3.12. Use a new virtual environment and synthetic or non-sensitive data for the examples.

git clone https://github.com/shadowhunter-92/agentbridge.git
cd agentbridge
# Pin the recorded reviewed main for this basic example:
git checkout --detach b0afb7f1da1634330747389e19c896fd7002bd83
python -m venv .venv

# Activate your virtual environment first:
# macOS/Linux: source .venv/bin/activate
# Windows PowerShell: .venv\Scripts\Activate.ps1

python -m pip install -e ".[mcp]"
python examples/quickstart.py
python examples/demo_story.py

This pins reviewed main, including opt-in tenant governance, queued acceptance, private preparation, first-admission linkage and audit payload limits. Use the documented opt-in tenant factory for tenant features. The private dispatch addition belongs to this later follow-up and requires its own selected-head evidence. Editable source installation is separate from the older local evaluator wheel or a signed public release. The CI badge tracks main; see exact source pins.

To execute the local test suite:

python -m pip install -e ".[test]"
python -m pytest tests/ -q

Some PostgreSQL tests require an explicit disposable test database and are skipped without it. Never point test or recovery drills at production data. Read CONTRIBUTING.md for the development setup.

Translate a tool call

from src.protocols import default_registry
from src.protocols.canonical import CanonicalCall

call = default_registry.get("openai").from_canonical_call(
    CanonicalCall("add", {"a": 2, "b": 3})
)
translated = default_registry.translate_call(call, "openai", "mcp")
print(translated)

This example translates a basic tool-call shape. It does not prove remote execution, authorization or full protocol lifecycle fidelity.

Architecture

flowchart LR
    A["Agent or application"] --> B["Identity / policy / approvals"]
    B --> C["Canonical protocol adapters"]
    C --> D["Approved target / tool"]
    B --> E["Budget + operation state"]
    D --> F["Outcome evidence / reconciliation"]
    E --> F
    F --> G["Audit + independent verification"]

The translation mesh is already useful on its own. The security-critical execution and evidence path is being qualified incrementally. A signed receipt is a statement from its signer, not automatic proof of a remote side effect.

One foundation, four proposed offerings

Offering	Intended role	Stage
AgentBridge OSS	Open-source adapters, examples and reusable SDK	Engineering alpha; installable verification SDK
AgentBridge Trust	Identity, policy, approvals and safe execution	Engineering and hardening
AgentBridge Evidence	Receipts, independent observation and audit verification	Bounded technical demonstrations
AgentBridge Enterprise	Managed policies, deployment, support and governance	Commercial hypothesis, not shipped

These are product directions, not four available paid products. Independent adoption and willingness to pay have not yet been established.

Documentation

Start here	What it covers
Quick API reference	Control plane interfaces
Integrations	Framework examples
Protocol support	Adapter mapping and limitations
Deployment	Developer setup and deployment considerations
Roadmap	Scope and known limitations
OSS evaluator kit	Pinned synthetic/read-only assessment
Production gate register	Review evidence and remaining blockers
Security policy	Responsible vulnerability disclosure
Contributing	Local setup, PRs, review expectations

Get involved

We especially welcome feedback from engineers building agents that change external state: payments, procurement, deployments, customer records or other operational systems. What breaks during retries? How do you verify that an action happened? What does your existing gateway already solve?

• Try the basic local examples and pinned synthetic evaluator workflow on main.
• Report a reproducible bug.
• Request a developer evaluation (no credentials, private logs or customer data in public issues).
• Propose an improvement, ideally with a bounded failing test.

Independent evaluations and comparisons are more useful than GitHub-star counts. We have not claimed external integrations or paying customers without verifiable evidence.

Security and license

AgentBridge does not guarantee exactly-once external execution, complete MCP/A2A standards conformance, independent custody of production signing keys, or readiness to run unsupervised high-impact actions. Review SECURITY.md before testing privileged functionality and do not post vulnerabilities or secrets in public issues.

Licensed under the Apache License 2.0. See AI assistance disclosure for development transparency.

This repository is the authoritative source for AgentBridge by shadowhunter-92; it is not affiliated with unrelated projects using the same name.

Maintained engineering alpha

The maintained source combines the alpha documentation, R4 implementation and reviewed audit fixes. Readiness depends on checks on the exact selected commit and independent operational acceptance; a source merge does not constitute certification.

See engineering release register, recovery/operator drills, limited protocol contract, release procedure, and external evaluator kit.

Local continuation checks

From the pinned source checkout, run python -m examples.qualify_trust_evidence for the controller-signed Trust/Evidence workflow. The optional durable task SDK is documented in task lifecycle. Run python tools/check_documentation.py to check local Markdown targets. Current source and branch evidence is indexed in current alpha status; the 88-row handoff register preserves its historical checkpoint.