Metadata-Version: 2.4
Name: zabta-broker
Version: 0.1.0b2
Summary: Zabta Broker — local credential-broker daemon for governing autonomous agents
Author-email: Zainova Labs LLC <hello@zabta.ai>
License-Expression: MIT
Project-URL: Homepage, https://zabta.ai
Project-URL: Documentation, https://zabta.ai/docs
Keywords: ai-agents,agent-governance,credential-broker,secrets-management,policy-enforcement,security,least-privilege
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: No Input/Output (Daemon)
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: fastapi<1.0,>=0.115
Requires-Dist: uvicorn[standard]<1.0,>=0.34
Requires-Dist: pydantic<3.0,>=2.0
Requires-Dist: pydantic-settings<3.0,>=2.0
Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0
Requires-Dist: aiosqlite<1.0,>=0.20
Requires-Dist: httpx<1.0,>=0.28
Requires-Dist: cryptography<44.0,>=42.0
Requires-Dist: keyring<27.0,>=25.0
Requires-Dist: argon2-cffi<24.0,>=23.0
Requires-Dist: PyNaCl<2.0,>=1.5
Requires-Dist: agent-os-kernel==3.1.0
Requires-Dist: click<9.0,>=8.0
Provides-Extra: dev
Requires-Dist: pytest<9.0,>=8.0; extra == "dev"
Requires-Dist: pytest-asyncio<1.0,>=0.24; extra == "dev"
Requires-Dist: httpx<1.0,>=0.28; extra == "dev"
Dynamic: license-file

# Zabta Broker

**A local credential-broker daemon that keeps API keys out of your AI agents' hands.**

Instead of pasting secrets into agent configs and environment variables, you store them in an encrypted local vault. Agents request a credential at the moment of use; the Broker verifies the agent's identity, evaluates policy, checks budgets, and either issues a short-lived lease, denies the request, or escalates to a human for approval. Every decision is written to a local audit log.

> **Pre-release (0.1.0b2).** This is an early beta: the wire protocol, CLI, and policy model may change without notice between releases. Evaluate it, but do not put production credentials behind it yet.

## Install

```bash
pip install zabta-broker==0.1.0b2
```

While the Broker is in beta, install each release by explicit version — `pip`
only resolves pre-releases when named exactly (and `--pre` would opt your
whole dependency tree into pre-release versions).

Requires Python 3.10+ on macOS or Linux.

## Quickstart

```bash
# 1. Store a secret in the encrypted local vault
zabta-broker vault add --provider stripe --scopes charges:create

# 2. Start the daemon (binds to 127.0.0.1:9477 — loopback only)
zabta-broker start

# 3. Connect to the Zabta control plane (policies, approvals, dashboards)
zabta-broker register --api-key <your-zabta-api-key>
```

On the agent side, use the [`zabta` SDK](https://pypi.org/project/zabta/). Set
`ZABTA_AGENT_ID` to your agent's id (shown in the Zabta dashboard) — the SDK
derives the agent's identity from it (`did:zabta:<agent id>`), and the Broker
learns the same identities from cloud sync, so nothing else needs configuring:

```bash
export ZABTA_AGENT_ID=<your agent id>
```

```python
import zabta

with zabta.credential("stripe", ["charges:create"]) as key:
    ...  # `key` is a fresh checkout; use it now, don't store it
```

To run the Broker as a background service (`launchd` on macOS, `systemd` on Linux):

```bash
zabta-broker install-daemon
```

## How a request is decided

Each credential request runs through a seven-step pipeline:

1. **Identity** — unknown or unregistered agent DIDs are hard-denied.
2. **Policy load** — applicable policies are read from the local policy cache.
3. **Evaluation** — policies are evaluated locally (default deny when nothing matches).
4. **Budget** — an allowed request that would exceed a spend budget is downgraded to a denial.
5. **Enforce or observe** — policies in observe mode always issue the credential but record what *would* have happened, so you can trial a policy without breaking an agent.
6. **Issue or refuse** — an allowed request gets a short-lived lease on the secret; a denial gets a reason.
7. **Audit** — every path, including denials, writes an audit record. Redacted summaries (agent DID fingerprints, no secret material) sync to the Zabta cloud.

## Scope — what the Broker does and does not do

We would rather you know exactly where the boundary is:

- **Enforcement happens at credential checkout.** Policy is evaluated when an agent *requests* a credential. Once a secret has been handed to the agent process, the Broker does not intercept or mediate what that process does with it.
- **The lease TTL bounds the lease record, not the secret.** When a lease expires, the agent must come back through policy to get the credential again — but expiry does not revoke, rotate, or invalidate the secret value already issued. Rotation remains your (or your provider's) responsibility.
- **Policies are managed in the Zabta cloud control plane.** The Broker pulls policies from your Zabta account and enforces a locally cached copy; approval verdicts are decided in the cloud (by your team, in the dashboard) and polled by the Broker. Offline, the Broker keeps enforcing the last-synced policies. An unregistered Broker has no policies, and no policy means **deny by default**.
- **Loopback plus a session token, not a network service.** The daemon refuses to bind to anything but 127.0.0.1, and requests must present a per-session token from a `0600` file. This protects against the network, not against other processes running as *your own user* — anything that can read your files can read that token.

## Security model

- The vault is encrypted at rest; the master key lives in your OS keychain (macOS Keychain / Secret Service), not on disk next to the data.
- The session token file and vault database live in `~/.zabta-broker/`, owner-readable only.
- Audit records synced to the cloud are redacted: agent DIDs are fingerprinted, secret values never leave the machine.

## License

MIT © Zainova Labs LLC
