Skip to content

Add Microsoft Defender for AI real-time protection on agent-hooks #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Krishnadheeraj (DheerajPannala) wants to merge 16 commits into from
+4,747 −3
Open

Add Microsoft Defender for AI real-time protection on agent-hooks #266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
31289b9
Add Microsoft Defender for AI real-time protection on agent-hooks
kpannala Oct 8, 2026
51a8f29
Address review findings for Defender RTP
kpannala Oct 8, 2026
00b783a
Keep the Defender verdict when the evaluation callback throws
kpannala Oct 8, 2026
d53b63b
Align Defender RTP behavior with the Node.js and Python SDKs
kpannala Oct 8, 2026
2eeba20
Do not authorize content Defender saw only truncated
kpannala Oct 8, 2026
bb7ff72
Fit Defender requests within a total budget and harden parsing
kpannala Oct 8, 2026
d22be9f
Harden Defender options, token cache and callback isolation
kpannala Oct 8, 2026
7559201
Rebuild the Defender envelope from spec fields and keep keys distinct
kpannala Oct 8, 2026
f81cbbe
Bound Defender content depth and keep reserved warning reasons out
kpannala Oct 8, 2026
b96fee0
Charge all copied structure to the Defender budget, keep exception te…
kpannala Oct 8, 2026
5ccece6
Bound token acquisition and tool reads, keep sequences and callbacks …
kpannala Oct 8, 2026
07c0003
Dispose the slow-callback test's event after the callback finishes
kpannala Oct 8, 2026
6e02840
Copy the called tool's declaration first and mark it unverified when cut
kpannala Oct 8, 2026
6ab7f61
Never follow redirects with Defender credentials, and key tokens by p…
kpannala Oct 8, 2026
f21a0b2
Match the called-tool rule across the SDKs
kpannala Oct 8, 2026
578854f
Reject unknown enable values and keep collision renaming linear
kpannala Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,28 @@ Both `Agent365.Observability.OtelWrite` (Delegated) and `Agent365.Observability.
`IExporterTokenCache<AgenticTokenStruct>`.

### Added
- **Microsoft.Agents.A365.Tooling** - Microsoft Defender for AI real-time protection client
- `DefenderRtpClient.EvaluateHookContextAsync` sends an agent-hooks/0.1 context to the Defender
prevention endpoint (`POST .../v1/protection/evaluate`) at the four points Defender evaluates
(`input`, `pre_tool_call`, `post_tool_call`, `output`) and returns its verdict (`deny` and
`transform` block). A copy of the context is fitted to Defender's request validation; the host's context is
not modified. One deadline (`A365_DEFENDER_RTP_TIMEOUT_MILLISECONDS`) covers token acquisition and the
request, and the endpoint and token authority must be absolute HTTPS URLs.
- Calls carry the agent identity's own app-only token for the Defender API
(`api://86a21212-634e-4553-b3d6-e477e4c9d9ec`, role `RealtimeProtection.Evaluate.All`), resolved by a
`DefenderRtpTokenResolver`, cached per agent and tenant and refreshed in the background before it expires;
`DefenderRtpTokenResolvers.FromAgenticConnection` uses the agent's connection (`IAgenticTokenProvider`), the
same authority as Observability S2S export.
- Every call sends a unique `x-ms-correlation-id`. Failures follow `A365_DEFENDER_RTP_FAIL_MODE` (`open` or
`closed`; any other value is rejected), and a `400` reports the failed validation rule. Each string is clamped
to `A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS`, and the copy carries at most four times that in all: the content
under decision first, the oldest history dropped first. When the content under decision, or at a tool point the
called tool's declaration, had to be cut, Defender's deny stands and its allow follows the fail mode
(`DefenderRtpEvaluationResult.Truncated`). Lone surrogates are sent as U+FFFD.
- **Microsoft.Agents.A365.Tooling.Extensions.AgentHooks** (new, preview) - `A365DefenderInterceptor`, an
agent-hooks interceptor (`ResponsibleAI.AgentHooks` 0.1.0-beta.1) for Defender, and
`A365AgentHooks.CreateProtectionEmitter` (`parallel/strictest`). When no agent identity is resolved, or resolving
it fails, the interceptor follows the fail mode.
- **Microsoft.Agents.A365.Tooling** - V1/V2 per-audience token support for MCP servers
- `MCPServerConfig` extended with `audience`, `scope`, `publisher`, and `Headers` fields
- `IMcpTokenProvider` interface for pluggable OAuth token acquisition
Expand Down
13 changes: 10 additions & 3 deletions docs/design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ src/
│ └── Extensions/
│ ├── SemanticKernel/ # SK tool registration
│ ├── AgentFramework/ # AF tool registration
│ └── AzureAIFoundry/ # Azure AI Foundry integration
│ ├── AzureAIFoundry/ # Azure AI Foundry integration
│ └── AgentHooks/ # agent-hooks Defender interceptor (preview)
└── Tests/ # Test projects
docs/
└── design.md # This file
Expand All @@ -52,10 +53,11 @@ docs/
| `Microsoft.Agents.A365.Observability.Extensions.SemanticKernel` | Semantic Kernel telemetry integration | [design.md](../src/Observability/Extensions/SemanticKernel/docs/design.md) |
| `Microsoft.Agents.A365.Observability.Extensions.OpenAI` | OpenAI SDK telemetry integration | [design.md](../src/Observability/Extensions/OpenAI/docs/design.md) |
| `Microsoft.Agents.A365.Notifications` | Microsoft 365 notification handling | [design.md](../src/Notification/Microsoft.Agents.A365.Notifications/docs/design.md) |
| `Microsoft.Agents.A365.Tooling` | MCP server discovery and configuration | [design.md](../src/Tooling/Core/docs/design.md) |
| `Microsoft.Agents.A365.Tooling` | MCP server discovery and configuration; Microsoft Defender for AI real-time protection client | [design.md](../src/Tooling/Core/docs/design.md) |
| `Microsoft.Agents.A365.Tooling.Extensions.SemanticKernel` | Semantic Kernel MCP tool registration | [design.md](../src/Tooling/Extensions/SemanticKernel/docs/design.md) |
| `Microsoft.Agents.A365.Tooling.Extensions.AgentFramework` | Agent Framework MCP tool registration | [design.md](../src/Tooling/Extensions/AgentFramework/docs/design.md) |
| `Microsoft.Agents.A365.Tooling.Extensions.AzureAIFoundry` | Azure AI Foundry MCP tool registration | [design.md](../src/Tooling/Extensions/AzureAIFoundry/docs/design.md) |
| `Microsoft.Agents.A365.Tooling.Extensions.AgentHooks` | Microsoft Defender for AI interceptor for agent-hooks hosts (preview) | [README.md](../src/Tooling/Extensions/AgentHooks/README.md) |

## Core Package Documentation

Expand Down Expand Up @@ -335,6 +337,9 @@ else if (EnvironmentUtils.IsDevelopmentEnvironment())
| `EnableAgent365Exporter` | Enable Agent365 telemetry exporter | `false` |
| `ASPNETCORE_ENVIRONMENT` | Environment name (Development, Production) | - |
| `SuppressInvokeAgentInput` | Suppress input messages in invoke_agent spans | `false` |
| `ENABLE_A365_DEFENDER_RTP` | Enable Microsoft Defender for AI real-time protection (`DefenderRtpOptions.FromEnvironment`); a value that is not true or false is rejected | `false` |
| `A365_DEFENDER_RTP_ENDPOINT` | Defender prevention endpoint, `https://<host>/v1/protection/evaluate` | - |
| `A365_DEFENDER_RTP_FAIL_MODE` | `open` or `closed` (blocks when Defender returns no verdict); any other value is rejected | open |

## Testing

Expand All @@ -349,9 +354,11 @@ src/Tests/
├── Microsoft.Agents.A365.Observability.Extension.Tests/
├── Microsoft.Agents.A365.Notifications.Tests/
├── Microsoft.Agents.A365.Tooling.Tests/
├── Microsoft.Agents.A365.Tooling.Core.Tests/
├── Microsoft.Agents.A365.Tooling.Extensions.SemanticKernel.Tests/
├── Microsoft.Agents.A365.Tooling.Extensions.AgentFramework.Tests/
└── Microsoft.Agents.A365.Tooling.Extensions.AzureAIFoundry.Tests/
├── Microsoft.Agents.A365.Tooling.Extensions.AzureAIFoundry.Tests/
└── Microsoft.Agents.A365.Tooling.Extensions.AgentHooks.Tests/
```

Run tests with:
Expand Down
2 changes: 2 additions & 0 deletions src/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@
<PackageVersion Include="Microsoft.Extensions.AI" Version="10.2.0" />
<PackageVersion Include="Microsoft.Extensions.AI.AzureAIInference" Version="10.0.0-preview.1.25559.3" />
<PackageVersion Include="Microsoft.Extensions.AI.OpenAI" Version="10.0.1-preview.1.25571.5" />
<!-- agent-hooks control contract (AGENT-HOOKS-0.1); native core for linux-x64, win-x64, osx-x64, osx-arm64. -->
<PackageVersion Include="ResponsibleAI.AgentHooks" Version="0.1.0-beta.1" />
<!-- Json packages -->
<PackageVersion Include="System.Text.Json" Version="10.0.4" />
<!-- Transitive pin: patches CVE-2026-26127 (GHSA-73j8-2gch-69rq) DoS in Microsoft.Bcl.Memory <= 10.0.3, pulled in via Microsoft.Agents.Connector.
Expand Down
33 changes: 33 additions & 0 deletions src/Microsoft.Agents.A365.Sdk.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,12 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Agents.A365.Tooli
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Agents.A365.Observability.Extensions.IntegrationTests", "Tests\Microsoft.Agents.A365.Observability.Extensions.IntegrationTests\Microsoft.Agents.A365.Observability.Extensions.IntegrationTests.csproj", "{260338F1-ABA4-4617-81F3-B84AAEA43D52}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "AgentHooks", "AgentHooks", "{4DDE42EC-71AD-50C7-6FC1-462738096C58}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Agents.A365.Tooling.Extensions.AgentHooks", "Tooling\Extensions\AgentHooks\Microsoft.Agents.A365.Tooling.Extensions.AgentHooks.csproj", "{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.Agents.A365.Tooling.Extensions.AgentHooks.Tests", "Tests\Microsoft.Agents.A365.Tooling.Extensions.AgentHooks.Tests\Microsoft.Agents.A365.Tooling.Extensions.AgentHooks.Tests.csproj", "{1F86A247-7BA3-4C49-A0BA-20F979849ED7}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Expand Down Expand Up @@ -378,6 +384,30 @@ Global
{260338F1-ABA4-4617-81F3-B84AAEA43D52}.Release|x64.Build.0 = Release|Any CPU
{260338F1-ABA4-4617-81F3-B84AAEA43D52}.Release|x86.ActiveCfg = Release|Any CPU
{260338F1-ABA4-4617-81F3-B84AAEA43D52}.Release|x86.Build.0 = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|Any CPU.Build.0 = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|x64.ActiveCfg = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|x64.Build.0 = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|x86.ActiveCfg = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Debug|x86.Build.0 = Debug|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|Any CPU.ActiveCfg = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|Any CPU.Build.0 = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|x64.ActiveCfg = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|x64.Build.0 = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|x86.ActiveCfg = Release|Any CPU
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0}.Release|x86.Build.0 = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|Any CPU.Build.0 = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|x64.ActiveCfg = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|x64.Build.0 = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|x86.ActiveCfg = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Debug|x86.Build.0 = Debug|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|Any CPU.ActiveCfg = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|Any CPU.Build.0 = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|x64.ActiveCfg = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|x64.Build.0 = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|x86.ActiveCfg = Release|Any CPU
{1F86A247-7BA3-4C49-A0BA-20F979849ED7}.Release|x86.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
Expand Down Expand Up @@ -417,6 +447,9 @@ Global
{0CBC637E-EC70-66CD-FE99-EB46F5448A6D} = {02EA681E-C7D8-13C7-8484-4AC65E1B71E8}
{5322E121-710E-4CBD-A5C4-0AC9E85F7164} = {2150E333-8FDC-42A3-9474-1A3956D46DE8}
{260338F1-ABA4-4617-81F3-B84AAEA43D52} = {2150E333-8FDC-42A3-9474-1A3956D46DE8}
{4DDE42EC-71AD-50C7-6FC1-462738096C58} = {89AD1AA2-300A-483A-832E-9047201DD2BC}
{3FEFA18B-FFD8-4CE0-8AC8-37AD209789F0} = {4DDE42EC-71AD-50C7-6FC1-462738096C58}
{1F86A247-7BA3-4C49-A0BA-20F979849ED7} = {2150E333-8FDC-42A3-9474-1A3956D46DE8}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {0B20062E-2453-4E32-B8A2-85A6013F83A0}
Expand Down
Loading
Loading