Agent Governance Toolkit 的框架适配器统一包 agent-governance-toolkit-integrationsextras 安装机制与旧包迁移指南【免费下载链接】agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.项目地址: https://gitcode.com/GitHub_Trending/ag/agent-governance-toolkit本文以agent-governance-toolkit-integrations的官方 README 为主体结合该包在仓库中的pyproject.toml、17 个适配器源码目录、以及docs/package-consolidation/下的迁移计划MIGRATION.md / PROPOSAL.md / AUDIT.md完整讲解这个一个发行版 可选 extras的框架适配器包如何安装、如何从源码层合并各框架适配器以及仍在使用agentmesh-langchain、crewai-agentmesh等旧独立包的用户应如何平滑迁移到新版 extras 安装方式。1. 包定位所有框架适配器收敛为单一发行版agent-governance-python/agent-governance-toolkit-integrations/README.md 对该包的定位只有一句话Agent Governance Toolkit 的框架适配器Framework adapters。所谓框架适配器是指把 LangChain、CrewAI、OpenAI Agents SDK 等主流 Agent 框架与 AGT 的治理能力身份验证、信任评分、策略执行、工具门控对接起来的适配层。该 README 给出的核心用法是按框架追加 extras 安装pip install agent-governance-toolkit-integrations[langchain] pip install agent-governance-toolkit-integrations[crewai,openai-agents]第二条命令展示了 extras 的组合能力一个项目同时用到 CrewAI 和 OpenAI Agents 时用逗号即可一次性装入两个适配器的依赖。README 同时指向 迁移指南说明该包是旧每框架一个独立包方案的替代品——这一迁移路径是理解本包存在意义的关键本文第 4、5 节会展开。从 pyproject.toml 可以看到该包唯一的强制依赖# No mandatory framework deps: each adapter is an optional extra. dependencies [ agent-governance-toolkit-core5.0.0,6.0, ]也就是说安装本包只会拉入agent-governance-toolkit-core策略引擎、信任评分、审计、身份、执行环等治理核心能力不会强制安装任何 Agent 框架。这正是extras 化设计的直接收益只用 LangChain 的项目不必背负 haystack、crewai 等无关依赖。2. 包元数据与 15 个可选 extras 全表当前仓库中该包版本为5.0.0许可证 MIT要求Python 3.11classifiers 覆盖 3.11 / 3.12 / 3.13构建后端为 hatchling。以下 extras 表完整取自 pyproject.toml 的[project.optional-dependencies]段是对 README 安装命令的直接参数化补充extra附加依赖版本约束说明langchainlangchain-core1.2.11,2.0LangChain 信任门控工具适配器crewaicrewai0.100.0,1.0CrewAI 适配器openai-agentsopenai-agents0.0.3,1.0OpenAI Agents SDK 适配器合并了两个旧包见第 5 节langgraphlanggraph0.2.0,1.0LangGraph 信任检查点适配器llamaindexllama-index-core0.12,0.13LlamaIndex 适配器haystackhaystack-ai2.0,3.0Haystack 适配器pydantic-aipydantic-ai0.0.10,1.0Pydantic AI 治理适配器adkgoogle-adk0.1.0,1.0Google ADK 适配器openshellpyyaml6.0,7.0唯一带第三方依赖的无框架 extraflowise无适配器纯 Python 实现无额外依赖langflow无同上avp无同上nostr-wot无Nostr Web of Trust 信任源structural-authz无结构化授权适配器audit-export无审计/问责导出适配器两点值得注意7 个 extra 依赖列表为空flowise、langflow、avp、nostr-wot、structural-authz、audit-export 等。这并不意味着这些适配器没有功能而是它们的适配器代码不引入额外第三方库安装 extra 只是把对应模块打包进来。devextrapytest8.0,10.0、pytest-asyncio0.23,2.0、ruff0.4.0,1.0仅面向贡献者pip install -e .[dev]可获得开发环境。[project.urls]中还声明了 Homepage、Documentation、Repository 与 Bug Tracker 四个链接[tool.ruff]段配置了target-version py311、line-length 100及 lint 规则集E, F, I, W忽略 E501与包声明的 Python 版本要求一致。3. 构建机制17 个适配器源码目录如何合并进一个 wheelpyproject.toml的 hatchling 配置段揭示了本包最关键的工程细节——它本身几乎没有源码wheel 内容全部从agentmesh-integrations/目录借过来[tool.hatch.build.targets.wheel] packages [_placeholder] [tool.hatch.build.targets.wheel.force-include] # Adapters with top-level module dirs ../agentmesh-integrations/langchain-agentmesh/langchain_agentmesh langchain_agentmesh ../agentmesh-integrations/crewai-agentmesh/crewai_agentmesh crewai_agentmesh ../agentmesh-integrations/openai-agents-agentmesh/openai_agents_agentmesh openai_agents_agentmesh ../agentmesh-integrations/langgraph-trust/langgraph_trust langgraph_trust ../agentmesh-integrations/llamaindex-agentmesh/llama_index llama_index ../agentmesh-integrations/agentmesh-avp/agentmesh_avp agentmesh_avp ../agentmesh-integrations/nostr-wot/agentmesh_nostr_wot agentmesh_nostr_wot ../agentmesh-integrations/structural-authz-agentmesh/structural_authz_agentmesh structural_authz_agentmesh ../agentmesh-integrations/openshell-skill/openshell_agentmesh openshell_agentmesh ../agentmesh-integrations/audit-accountability-export/audit_accountability_export audit_accountability_export ../agentmesh-integrations/template-agentmesh/template_agentmesh template_agentmesh # Adapters with src/ layout ../agentmesh-integrations/haystack-agentmesh/src/haystack_agentmesh haystack_agentmesh ../agent-governance-python/agentmesh-integrations/flowise-agentmesh/src/flowise_agentmesh flowise_agentmesh ../agentmesh-integrations/langflow-agentmesh/src/langflow_agentmesh langflow_agentmesh ../agentmesh-integrations/adk-agentmesh/src/adk_agentmesh adk_agentmesh ../agentmesh-integrations/pydantic-ai-governance/src/pydantic_ai_governance pydantic_ai_governance ../agentmesh-integrations/openai-agents-trust/src/openai_agents_trust openai_agents_trust上方flowise一行为示意笔误更正实际内容均为../agentmesh-integrations/...相对路径以仓库文件 pyproject.toml L72-L94 为准。从该配置可以读出三条实现事实源目录不搬移。PROPOSAL.md 明确写着Source code does not move. The directory layout underagent-governance-python/stays the same. Only packaging metadata changes。各适配器仍在 agent-governance-python/agentmesh-integrations/ 下独立开发、独立测试构建时才被force-include收进统一 wheel。兼容两种目录布局11 个适配器使用顶层模块目录如langchain-agentmesh/langchain_agentmesh/6 个使用src/布局如haystack-agentmesh/src/haystack_agentmesh/映射时按各自实际路径取模块包。extra 与模块不是一一对应。例如[openai-agents]一个 extra 对应openai_agents_agentmesh与openai_agents_trust两个模块来自两个已合并的旧包而template_agentmesh模板适配器没有对应 extra随 wheel 始终包含。sdist 则只打包README.md与LICENSE[tool.hatch.build.targets.sdist]完整源码依赖 git 仓库本身。4. 迁移指南旧独立包用户如何过渡docs/package-consolidation/MIGRATION.md 是 README 所指向的迁移计划全文其指导原则是任何现有安装命令都不能失效requirements 里已写死agentmesh-langchain3.x的项目在整合发布后依然能装上可工作的依赖。该计划分三个阶段执行阶段一发布 stub转发桩包在旧包名下发布一个版本 4.0.0 的桩包唯一作用是把 pip 重定向到新发行版。以本包直接相关的旧包为例其迁移映射为摘自 MIGRATION.md 的 Package Mapping 表旧包名迁移目标是否提供 stubagentmesh-langchainagent-governance-toolkit-integrations[langchain]是crewai-agentmeshagent-governance-toolkit-integrations[crewai]是openai-agents-agentmeshagent-governance-toolkit-integrations[openai-agents]是agentmesh-openai-agents-trustagent-governance-toolkit-integrations[openai-agents]是langgraph-agentmeshagent-governance-toolkit-integrations[langgraph]是llamaindex-agentmeshagent-governance-toolkit-integrations[llamaindex]是haystack-agentmeshagent-governance-toolkit-integrations[haystack]是pydantic-ai-agentmeshagent-governance-toolkit-integrations[pydantic-ai]是flowise-agentmeshagent-governance-toolkit-integrations[flowise]是langflow-agentmeshagent-governance-toolkit-integrations[langflow]是adk-agentmeshagent-governance-toolkit-integrations[adk]是avp-agentmeshagent-governance-toolkit-integrations[avp]是nostr-wot-agentmeshagent-governance-toolkit-integrations[nostr-wot]是structural-authz-agentmeshagent-governance-toolkit-integrations[structural-authz]是openshell-agentmeshagent-governance-toolkit-integrations[openshell]是agentmesh-audit-exportagent-governance-toolkit-integrations[audit-export]否从未发布cedarling-agentmesh移除改用原生 ACS Cedar 策略配置或自定义策略分发器否stub 包的 pyproject 形态在 MIGRATION.md 中有标准示例以agentmesh-runtime为例[project] name agentmesh-runtime version 4.0.0 description Deprecated. Replaced by agent-governance-toolkit-core. dependencies [agent-governance-toolkit-core4.0.0]stub 与新发行版同时发布避免出现一个已发、另一个未发的空窗期。阶段二运行时弃用警告stub 包被导入时抛出DeprecationWarning指向替代方案与迁移文档让通过 stub 安装的开发者有明确信号去更新 requirements但构建不受影响。警告自首个整合版本起存在至少保留两个 minor 版本。阶段三撤回 stub两个 minor 版本周期按 AGT 常规发布节奏约 6 个月后stub 包从 PyPI yank。由于近期运行过测试的开发者都应已见过警告撤回不构成意外。导入兼容性与版本号规则导入路径不变MIGRATION.md 规定当两个旧包合并进一个发行版时公开模块名与类名不得改变——Users import classes directly, not package metadata names。若模块路径必须变更需在旧位置放兼容性 shim例如# agentmesh/openai_agents_trust/__init__.py (compatibility shim) import warnings from agentmesh.integrations.openai_agents import * # noqa: F401, F403 warnings.warn( agentmesh.openai_agents_trust is deprecated. Import from agentmesh.integrations.openai_agents., DeprecationWarning, stacklevel2, )版本号信号迁移计划宣布整合发行版自 4.0.0 起步以 major bump 提示依赖管理工具复核升级。而当前仓库中agent-governance-toolkit-integrations已是5.0.0说明计划落地后又经历了一次大版本迭代新安装用户直接以 5.x 为准对存量用户而言stub 转发到5.0.0,6.0的 extras 包见下节实际 stub 文件。5. 迁移的仓库实证agentmesh-langchainstub 长什么样迁移计划不是纸面流程仓库里保留了真实的 stub 实现。以 LangChain 适配器为例agent-governance-python/agentmesh-integrations/langchain-agentmesh/pyproject.toml 就是一个完整 stub[project] name agentmesh_langchain version 5.0.0 description Deprecated. Previously published as agentmesh-langchain. Install agent-governance-toolkit-integrations[langchain] instead. dependencies [agent-governance-toolkit-integrations[langchain]5.0.0,6.0] [project.urls] Migration Guide https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/package-consolidation/MIGRATION.md [tool.hatch.build.targets.wheel] packages [langchain_agentmesh]它同时做了三件事(1) 版本与描述中明示弃用并给出新安装命令(2) 依赖声明直接把agent-governance-toolkit-integrations[langchain]作为唯一依赖实现 pip 重定向(3) 仍打包自己的langchain_agentmesh模块保证旧导入路径可用。配套的运行时警告在 langchain_agentmesh/init.py 中import warnings warnings.warn( agentmesh-langchain is deprecated and will be removed in a future release. Use agent-governance-toolkit-integrations[langchain] instead. See .../docs/package-consolidation/MIGRATION.md, DeprecationWarning, stacklevel2, ) from langchain_agentmesh.identity import VerificationIdentity, VerificationSignature, UserContext from langchain_agentmesh.trust import ( TrustedAgentCard, TrustHandshake, TrustVerificationResult, TrustPolicy, DelegationChain, Delegation, AgentDirectory, ) from langchain_agentmesh.tools import TrustGatedTool, TrustedToolExecutor from langchain_agentmesh.callbacks import TrustCallbackHandler从源码结构看该模块在被导入时先发出指向迁移文档的DeprecationWarning再原样重导出VerificationIdentity、TrustGatedTool、TrustedToolExecutor、TrustCallbackHandler等全部公共 API——这正是 MIGRATION.md 所述导入兼容 弃用警告两阶段策略的落地形态。适配器自身的功能实现如 identity.py 的 Ed25519 验证身份、tools.py 的信任门控工具执行器与测试tests/test_agentmesh.py都保留在 agent-governance-python/agentmesh-integrations/langchain-agentmesh/ 目录中供统一包构建时收编。其他适配器目录crewai-agentmesh/、openai-agents-trust/、haystack-agentmesh/等均遵循同样的独立目录 独立 pyproject 独立测试结构目录级说明见 agent-governance-python/agentmesh-integrations/README.md。6. 为什么做这次整合背景数据理解这个统一包的价值需要回到 PROPOSAL.md 给出的动机与 AUDIT.md 记录的审计数据审计日期 2026-05-23下载量取自 pypistats 最近 30 天仓库当时有45 个 Python 包其中仅 11 个有 PyPI 下载流量维护 45 份pyproject.toml、版本 pin 与 CI 作业对月下载不足千次的包而言是纯开销。版本漂移已现形除cedarling-agentmesh停在 3.5.0 外其余包均为 3.7.0——0.2 的版本差就是 45 份清单手工升版时必然出现的跨包漂移。下载高度集中agent-sandbox约 87K/月、agent-governance-toolkit约 63K/月、agent-os-kernel约 59K/月、agent-sre约 46K/月、agentmesh-runtime约 37K/月五个包贡献了绝大多数安装量整合必须为它们保留原名或别名。框架集成包小而均匀每个集成包月下载约 500760 次且结构模式完全一致。PROPOSAL 据此决定把 21 个独立集成包折叠为单一 integrations 发行版的可选 extras并设定了保留独立包的门槛——月下载超过 5000 且社区采用度高的适配器会被单独评估后再决定是否合并当时无一达标。命名空间混乱旧包横跨agent_*、agentmesh_*、avp_*、cedarling_*、nostr_*等前缀无共享命名空间。整合后统一使用agent-governance-toolkit-*前缀。最终目标是 5 个顶层发行版agent-governance-toolkitmeta 入口、-core治理核心、-integrations即本文主角、-cli运维侧 CLI/代理服务、-protocols可独立消费的外部协议实现agent-discovery等 6 个包因边界清晰保持独立。7. 安装与迁移操作速查综合以上各节面向读者的落地操作只有三类新项目直接按所用框架安装 extrasPython 3.11pip install agent-governance-toolkit-integrations[langchain] pip install agent-governance-toolkit-integrations[crewai,openai-agents] # 多框架组合存量项目requirements 中为旧包名无需立刻改动——旧名下 4.0.0/5.0.0 stub 会自动拉取agent-governance-toolkit-integrations对应 extra原导入语句继续工作在依赖告警周期内把 requirements 替换为上表迁移目标列即可代码导入路径保持不变。贡献者适配器源码仍在agentmesh-integrations/各子目录独立演进本地开发可对各目录单独装[dev]依赖运行测试统一包的打包由 hatchlingforce-include在构建时完成无需手工同步目录。需要注意的适用前提本包要求 Python ≥ 3.11extras 中各框架依赖的版本区间如langchain-core1.2.11,2.0、crewai0.100.0,1.0是仓库当前 pin 的实际取值若你的框架版本超出区间升级需等待该包调整依赖约束cedarling-agentmesh是唯一移除而非迁移的旧包使用 Cedar 策略的用户应改用原生 ACS Cedar 配置或自定义策略分发器而非等待兼容包。【免费下载链接】agent-governance-toolkitAI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.项目地址: https://gitcode.com/GitHub_Trending/ag/agent-governance-toolkit创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考