tracking: wasmagent-py — Python-native runtime protection layer (deferred, strategic decision needed)

[telleroutlook]

What this is

A strategic gap identified during an ecosystem audit (2026-07-18). Tracked here as an org-level reminder so it is not forgotten.

The gap

The WasmAgent ecosystem's runtime protection layer (mcp-firewall, taint tracking, policy enforcement, ApprovalPolicy) is entirely TypeScript/JS. It targets the JS/TS AI agent stack: Vercel AI SDK, Mastra, Cloudflare Agents SDK, bscode.

The dominant enterprise Python agent frameworks — LangChain, LlamaIndex, AutoGen, CrewAI — have no equivalent runtime protection. The only Python surface in the current ecosystem is a handful of AEP emitter example scripts. Python agents can use AEP for post-hoc auditing via open-agent-audit, but there is no equivalent of mcp-firewall (runtime interception, taint tracking, tool call policy enforcement) available to Python runtimes.

Why it is deferred

This is not a missing feature in the current scope — it is a strategic question about which user population to target:

• If WasmAgent's primary positioning is as the trust layer for the JS/TS AI SDK ecosystem (Cloudflare Workers, Mastra, bscode pattern), Python coverage is out of scope and this remains a known gap.
• If WasmAgent intends to expand to enterprise Python agent users (LangChain/AutoGen shops), a wasmagent-py project would need to be built from scratch. There is no Rust core to bind against (wasmagent-js is pure TypeScript); the implementation would need to be independent.

What wasmagent-py would need to do

To reach feature parity with the JS-side runtime layer:

1. MCP firewall equivalent — intercept tool calls and return values, run prompt-injection detection, enforce consent/capability policy
2. Taint tracking — propagate taint labels through tool return values into agent reasoning context
3. ApprovalPolicy — gate high-risk tool calls (file write, delete, shell exec) pending human review, emit ApprovalRequest records to a shared store
4. AEP emission — emit structured AEPEvent records compatible with @openagentaudit/schema so audit trail is unified across JS and Python agents
5. Framework adapters — LangChain tool wrapper, LlamaIndex tool spec wrapper, AutoGen function call hook, CrewAI tool decorator

Implementation note

There is no shortcut via FFI or Wasm binding — wasmagent-js has no compiled native core. A wasmagent-py project would be a ground-up Python implementation sharing only the AEP JSON schema contract with the existing ecosystem.

Decision needed before starting

• Confirm Python enterprise users are a target audience for WasmAgent
• If yes: decide whether this is a new top-level repo (WasmAgent/wasmagent-py) or a packages/py subdirectory in wasmagent-js
• Scope MVP: AEP emission only (thin) vs. full mcp-firewall parity (heavy)

Status

Deferred — no timeline. Revisit when strategic positioning is clarified.

[telleroutlook]

This looks like a strategic roadmap discussion rather than a concrete implementation issue. I’d keep it open for maintainer input on whether Python runtime protection belongs in scope, and only split into actionable work once that direction is decided.

— automated triage by patrol bot

[telleroutlook]

Valid strategic tracking issue for future roadmap consideration. Acknowledged as deferred scope requiring org-level decision on Python ecosystem support.

— automated triage by patrol bot

[telleroutlook]

This is a strategic roadmap item rather than a scoped feature or bug. To move it forward, we should capture the decision criteria (target user population, maintainer capacity, ecosystem demand signals) and either schedule it for a planning discussion or convert it into a tracking epic with explicit owners. Marking as discussion for now.

— automated triage by patrol bot

[telleroutlook]

This is a strategic tracking item rather than a scoped feature request, so labeling it for discussion is the right call. To keep it actionable, it would help to capture the decision criteria (e.g., customer demand signals from LangChain/AutoGen users, maintenance cost of a second runtime, and whether AEP post-hoc auditing sufficiently covers Python for now) and a target revisit date so it doesn't sit indefinitely without a decision.

— automated triage by patrol bot

[telleroutlook]

Thanks for documenting this strategic gap — this reads as an org-level tracking item for a deferred decision rather than an actionable feature. Could you add a rough decision deadline or the criteria that would prompt revisiting (e.g., Python-framework adoption signal, enterprise demand), so we know when to take it up? Until then I'll leave it open as a discussion item.

— automated triage by patrol bot