github Python analyzed 45c2ffd no deep scan

strands-agents/sdk-python

github

A model-driven approach to building AI agents in just a few lines of code.

maintainer: strands-agents
licence: Apache-2.0
first seen: 2026-06-01
last seen: 2026-06-02
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools

transport stdio · streamable-http · http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

fetch_doc
search_docs

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 45c2ffd · analyzer v33 · 3d ago

skills & prompt files 20

danger signals5

dynamic code execution __import__() strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/loader.py :218 module = __import__(module_path, fromlist=["*"])
dynamic code execution eval()/exec() strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/middleware/test_execute_tool_middleware.py :24 return str(eval(expression))
dynamic code execution eval()/exec() strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/middleware/test_middleware_interrupts.py :27 return str(eval(expression))
dynamic code execution pickle.loads() strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/types/test_json_dict.py :182 @pytest.mark.parametrize("clone", [copy.deepcopy, lambda state: pickle.loads(pickle.dumps(state))])
dynamic code execution eval()/exec() strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_bedrock.py :159 return eval(expression)

code evidence vtypescript/v1.4.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1552

filesystem 46

fs (weak) strands-agents-harness-sdk-45c2ffd/site/docs/examples/cdk/deploy_to_lambda/bin/package_for_lambda.py :19 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/site/docs/examples/python/file_operations.py :99 with open(test_file, "w") as f:
fs (weak) strands-agents-harness-sdk-45c2ffd/site/docs/examples/python/knowledge_base_agent.py :27 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/site/scripts/api-generation-python.py :16 import shutil
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-mcp/tests/test_dependencies.py :4 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/experimental/agent_config.py :15 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/experimental/bidi/io/audio.py :224 self._stream = self._audio.open(
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/injection/_message_injection.py :104 always-true gate; a user-supplied predicate is wrapped so that a raise fails open (logs and
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/injection/types.py :77 whether to inject this call. A predicate that raises fails open (injection is
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/memory/memory_manager.py :654 nothing. The rendering callback raising fails open (returns ``None``).
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/memory/types.py :194 open (injection is skipped). Defaults to a ``<memory>`` XML block with one
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/sandbox/not_a_sandbox_local_environment.py :20 from pathlib import Path

show 28 more

fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/session/file_session_manager.py :6 import shutil
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/storage/local_file_storage.py :9 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/loader.py :8 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/mcp/mcp_client.py :26 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/registry.py :14 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/watcher.py :8 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_interventions/cedar/_file_loaders.py :6 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_memory_stores/test_memory_store/store.py :14 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_plugins/context_injector/plugin.py :52 fails open (injection is skipped, the model call proceeds).
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_plugins/context_offloader/storage.py :26 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_plugins/skills/agent_skills.py :20 from pathlib import Path
fs strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_plugins/skills/skill.py :16 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/conftest.py :78 with path.open("w") as fp:
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/experimental/bidi/agent/test_loop.py :851 the reply does not leave the turn falsely open (which would burn the alignment wait and flag a
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/experimental/test_agent_config.py :61 os.remove(temp_path)
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/multiagent/test_swarm.py :2 import shutil
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/session/test_file_session_manager.py :85 with open(session_file) as f:
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/session/test_file_session_manager_symlink_protection.py :8 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/tools/mcp/test_mcp_client.py :1160 with open("tests_integ/resources/yellow.png", "rb") as image_file:
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_interventions/cedar/test_cedar_authorization.py :3 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_interventions/cedar/test_cedar_integration.py :7 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_memory_stores/test_memory_store/test_store.py :15 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_plugins/context_offloader/test_storage.py :10 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_plugins/skills/test_agent_skills.py :13 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_plugins/skills/test_skill.py :4 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/bidi/generators/audio.py :10 from pathlib import Path
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/conftest.py :149 with open(path, "rb") as fp:
fs (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/mcp/echo_server.py :101 with open("tests_integ/resources/yellow.png", "rb") as image_file:

6 more not shown — this panel samples each group; the count above is the real total.

shell / exec 3

shell (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/a2a/test_multiagent_a2a.py :2 import subprocess
shell (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/sandbox/conftest.py :21 import subprocess
shell (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/sandbox/test_docker.py :9 import subprocess

network 36

net strands-agents-harness-sdk-45c2ffd/strands-mcp/src/strands_mcp_server/server.py :3 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-mcp/src/strands_mcp_server/utils/doc_fetcher.py :3 import urllib.request
net (weak) strands-agents-harness-sdk-45c2ffd/strands-mcp/tests_integ/test_parse_pipeline.py :3 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/agent/a2a_agent.py :16 import httpx
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/models/anthropic.py :12 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/models/llamacpp.py :24 import httpx
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/multiagent/a2a/server.py :9 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/mcp/_compat.py :22 import httpx
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/tools/mcp/mcp_client.py :30 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_plugins/skills/skill.py :13 import urllib.error
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_tools/__init__.py :11 :func:`make_http_request` to supply a pre-configured ``httpx.AsyncClient``
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_tools/http_request/__init__.py :3 The tool delegates all networking to an ``httpx.AsyncClient`` — either one

show 24 more

net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_tools/http_request/http_request.py :6 The tool is a thin shim over ``httpx.AsyncClient``. It delegates all
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_tools/web_fetch/_extract.py :12 from urllib.parse import urlparse
net strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/vended_tools/web_fetch/web_fetch.py :13 The tool delegates all networking to the ``httpx.AsyncClient`` instance
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/agent/test_a2a_agent.py :39 """Create a mock httpx.AsyncClient that works as async context manager."""
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/models/test_llamacpp.py :8 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/models/test_openai.py :5 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/models/test_openai_responses.py :5 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/tools/mcp/test__compat.py :21 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/tools/mcp/test_mcp_client_auth.py :5 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/tools/mcp/test_mcp_instrumentation_v2.py :17 import socket
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_plugins/skills/test_agent_skills.py :873 f"{self._SKILL_MODULE}.urllib.request.urlopen", return_value=self._mock_urlopen(self._SAMPLE_CONTENT)
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_plugins/skills/test_skill.py :596 with patch(f"{self._SKILL_MODULE}.urllib.request.urlopen", return_value=mock_response):
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_tools/test_http_request.py :9 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/vended_tools/test_web_fetch.py :9 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/a2a/test_multiagent_a2a.py :5 import httpx
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/mcp/test_mcp_client.py :471 import aiohttp
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/mcp/test_mcp_client_tasks.py :4 import socket
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/mcp/test_mcp_client_v2.py :15 import socket
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/memory/_bedrock_kb_test_helpers.py :15 from urllib.parse import urlparse
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/providers.py :8 import requests
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_mantle_routing.py :19 import urllib.error
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_openai.py :4 from urllib.parse import urlparse
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/sandbox/conftest.py :19 import socket
net (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/test_a2a_executor.py :9 import requests

secrets 16

secrets (weak) strands-agents-harness-sdk-45c2ffd/site/docs/examples/python/memory_agent.py :68 # os.environ['AWS_SECRET_ACCESS_KEY'] = "your-aws-secret-access-key"
secrets strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/experimental/bidi/models/openai.py :146 self.api_key = api_key if api_key is not None else os.getenv("OPENAI_API_KEY")
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/providers.py :74 "api_key": os.getenv("ANTHROPIC_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_anthropic.py :26 "api_key": os.getenv("ANTHROPIC_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_cohere.py :19 "api_key": os.getenv("COHERE_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_gemini.py :19 client_args={"api_key": os.getenv("GOOGLE_API_KEY")},
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_litellm.py :290 model = LiteLLMModel(model_id="gemini/gemini-2.5-flash", client_args={"api_key": os.environ.get("GOOGLE_API_KEY")})
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_llamaapi.py :20 "api_key": os.getenv("LLAMA_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_mistral.py :19 api_key=os.getenv("MISTRAL_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_openai.py :37 "api_key": os.getenv("OPENAI_API_KEY"),
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_model_writer.py :19 client_args={"api_key": os.getenv("WRITER_API_KEY", "")},
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/models/test_openai_session_cache_key.py :87 client_args={"api_key": os.getenv("OPENAI_API_KEY")},

show 4 more

secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/test_prompt_cache_per_call_content.py :50 client_args={"api_key": os.getenv("ANTHROPIC_API_KEY")},
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/test_session.py :175 client_args={"api_key": os.getenv("OPENAI_API_KEY")},
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/test_snapshot_session.py :121 client_args={"api_key": os.getenv("OPENAI_API_KEY")},
secrets (weak) strands-agents-harness-sdk-45c2ffd/strands-py/tests_integ/test_summarizing_conversation_manager_integration.py :35 "api_key": os.getenv("ANTHROPIC_API_KEY"),

database 1

db strands-agents-harness-sdk-45c2ffd/strands-py/src/strands/storage/search/bm25.py :21 import sqlite3

tool registrations 2

search_docs strands-agents-harness-sdk-45c2ffd/strands-mcp/src/strands_mcp_server/server.py :24
fetch_doc strands-agents-harness-sdk-45c2ffd/strands-mcp/src/strands_mcp_server/server.py :83

declared dependencies 4

ruff@>=0.13.0,<0.15.0
pyright@>=1.1.400
pytest@>=9.0.3
pytest-asyncio@>=1.3.0

transport_posture 6

network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/site/docs/examples/cdk/deploy_to_apprunner/docker/app/app.py :108 uvicorn.run(app, host='0.0.0.0', port=port)
network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/site/docs/examples/cdk/deploy_to_ec2/app/app.py :112 uvicorn.run(app, host='0.0.0.0', port=port)
network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/site/docs/examples/cdk/deploy_to_fargate/docker/app/app.py :114 uvicorn.run(app, host='0.0.0.0', port=port)
network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/site/docs/examples/deploy_to_eks/docker/app/app.py :114 uvicorn.run(app, host='0.0.0.0', port=port)
network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/site/src/content/docs/user-guide/deploy/deploy_to_docker/agent.py :51 uvicorn.run(app, host="0.0.0.0", port=8080)
network-listening, binds all interfaces, no auth detected strands-agents-harness-sdk-45c2ffd/strands-py/tests/strands/multiagent/a2a/test_server.py :542 mock_strands_agent, host="0.0.0.0", port=8080, http_url="http://my-alb.amazonaws.com", skills=[]