RagLeap Packages
Looking for the AI employee system? This page documents the alpha pip install ragleap-security package, small security primitives for the ragleap libraries. To install and run ragleap-core (AI employees, channels, Docker), see the install documentation.
Alpha · 54 test functions · not independently audited

ragleap-security

Open-source (MIT), small, auditable security primitives for the ragleap libraries: tenant scopes, a hash-chained audit log, secret handling and hard input limits. Standard library only. The library has had no independent security review.

0.1.0
PyPI version
0
Runtime dependencies
54
Test functions

Install

Python 3.10 or newer, with no dependencies.

pip install ragleap-security
# or, with uv
uv add ragleap-security
from ragleap_security import AuditLog, Scope, SecretStr, from_env, redact

scope = Scope("acme", subject="alice")
log = AuditLog("audit.jsonl")
token = from_env("MY_SERVICE_TOKEN")
log.append("login.ok", {"user": "alice", "token": token}, scope)
assert log.verify().ok
print(redact(f"request failed with {token.reveal()}", [token]))

Modules

Scope
An immutable tenant scope (tenant, subject, agent, session) with an unambiguous key, plus covers, narrow and require_scope. ragleap-memory builds on it.
AuditLog
An append-only JSON Lines log with a SHA-256 hash chain and verify(). Tamper-evident, not tamper-proof.
SecretStr, from_env, redact
Secrets that do not print themselves, are read from the environment by name, and a heuristic redactor for logs.
check_size, check_json_shape, bounded_read, Deadline
Hard limits for untrusted input.

Verified

  • 0.1.0 (from its changelog): 101 tests pass on Python 3.10 and 3.12, the CI test job passes on 3.10, 3.11 and 3.12, and all 30 deliberate breaks of a protection are killed by the mutation check on 3.10 and 3.12.
  • Threat model: six threats are listed: a missing or forged tenant scope, a secret printed or serialized by accident, edits to the audit log, forged audit records, hostile input that exhausts memory or CPU, and concurrent writers corrupting the audit chain. The last is covered by thread and process tests and is not mutation-checked.

Known limitations

  • Alpha, not independently audited. Read the threat model before relying on it.
  • Not in 0.1.0: encryption, an SSRF-safe HTTP helper, a policy engine, output detectors and a red-team harness. These are planned and not available.