zooqueenandHanzo Dev 36b5e4f7a7 fix(publish): pull PyPI tokens from KMS, the only secret store we use
hanzo-iam 1.30.2 was tagged, the tag reached git.hanzo.ai, a runner picked the
job up, and it failed in 56s. The job read `secrets.PYPI_TOKEN` off the forge,
and no such secret is there — the hanzoai org carries GHCR_TOKEN, GHCR_USER,
GH_PAT, KMS_CLIENT_ID, KMS_CLIENT_SECRET, OCI_TOKEN, OCI_USER, REGISTRY_TOKEN
and nothing for PyPI. So its own guard fired and PyPI stayed on 1.30.0, which
still calls the legacy verb routes the server is removing.

That secret is absent because it is not supposed to be there. hanzoai/extension
states the contract: the KMS machine identity is the single bootstrap credential
on the forge, and every publish credential is pulled from KMS at run time. This
job was the one that had not been migrated, so it asked the forge for something
the contract forbids storing.

Now it follows the same shape: KMS login, then PYPI_TOKEN and
HANZO_AI_PYPI_TOKEN from org `hanzo`, env `prod`, path `python-sdk-publish`.
Both are masked. The two-token fallback is unchanged — PYPI_TOKEN owns most
hanzo-* projects, HANZO_AI_PYPI_TOKEN the rest, so a 403 scope-miss on one is
covered by the other.

Absent credentials still FAIL rather than skip. A publish that no-ops and
reports green is worse than one that breaks, which is the lesson extension paid
for with v1.9.37.

The tokens exist as GitHub repo secrets, where values are write-only and cannot
be read out, so they must be seeded into KMS by hand once.

Also corrected the header: the HTTP 422 that motivated leaving GitHub no longer
reproduces (Actions ran green there on 2026-07-28). The migration stands on its
own terms, and the note now says so rather than resting on a stale symptom.

Co-authored-by: Hanzo Dev <[email protected]>
2026-07-29 06:15:12 -07:00
2025-03-15 03:31:14 +00:00
2025-03-15 03:31:14 +00:00
2026-06-26 11:57:39 -07:00
2025-03-15 03:56:11 +00:00

Hanzo Python SDK

Hanzo Python SDK

The flagship Python SDK for the Open AI Cloud — models, agents, tools, memory, and MCP in one install.

CI PyPI Python Version License

This is the most complete Hanzo SDK — a uv workspace of 60+ composable packages covering the full AI surface: the typed cloud client, an agent framework, the Model Context Protocol server and tools, persistent memory + RAG, distributed compute, and a batteries-included CLI. If you build AI in Python, start here.

Install

pip install hanzo          # flagship: CLI + agents + MCP + client

Or install exactly what you need:

pip install hanzoai        # just the typed cloud API client
pip install "hanzo[all]"   # everything, including optional extras

Quickstart

from hanzoai import ApiClient, Configuration, AiOpenAICompatibleApi
from hanzoai import AiChatCompletionRequest, AiChatMessage

config = Configuration(host="https://api.hanzo.ai", access_token="sk-...")

with ApiClient(config) as client:
    ai = AiOpenAICompatibleApi(client)
    resp = ai.ai_create_chat_completion(
        AiChatCompletionRequest(
            model="zen-coder",
            messages=[AiChatMessage(role="user", content="Ship it.")],
        )
    )
    print(resp.choices[0].message.content)

Every route is https://api.hanzo.ai/v1/<service>/*. Models come from the Zen family (our own models) plus any provider you connect — one typed client, no proxy in the middle.

Packages

The workspace splits cleanly by concern. The headline packages:

Package Purpose
hanzoai Typed cloud API client (generated from the Hanzo OpenAPI surface).
hanzo The hanzo CLI + runtime that ties everything together.
hanzo-mcp Model Context Protocol server — discovers tools via entry points.
hanzo-agents / hanzo-agent Agent framework — build and orchestrate agents and swarms.
hanzo-network Distributed AI compute and node orchestration.
hanzo-memory Persistent memory + RAG (SQLite, optional vector backends).
hanzo-tools-* 60+ single-concern tool packages (shell, browser, fs, code, vector, iam, …), each exposing a TOOLS list.
python-sdk/
└── pkg/
    ├── hanzoai/          # typed cloud client (OpenAPI-generated)
    ├── hanzo/            # CLI + runtime meta package
    ├── hanzo-mcp/        # MCP server (entry-point tool discovery)
    ├── hanzo-agents/     # agent framework
    ├── hanzo-network/    # distributed compute
    ├── hanzo-memory/     # memory + RAG
    └── hanzo-tools-*/    # composable tool packages

CLI

pip install hanzo gives you the hanzo command:

hanzo chat            # chat with the Zen models
hanzo node            # start / manage a local compute node
hanzo mcp             # run the MCP server for your editor or agent
hanzo agent           # build and run agents
hanzo run             # run a workflow
hanzo cloud           # manage cloud resources
hanzo search          # AI-powered search

Run hanzo --help for the full command tree.

Model Context Protocol (hanzo-mcp)

hanzo-mcp hosts the MCP server and discovers tools through [project.entry-points."hanzo.tools"], so any installed hanzo-tools-* package lights up automatically.

from hanzo_mcp import create_mcp_server

server = create_mcp_server()
server.register_tool(my_tool)
server.start()

Agents (hanzo-agents)

from hanzo_agents import Agent, Swarm

agent = Agent(
    name="researcher",
    model="zen-coder",
    instructions="You are a research assistant.",
)

swarm = Swarm([agent])
result = await swarm.run("Research quantum computing.")

Network (hanzo-network)

from hanzo_network import LocalComputeNode, DistributedNetwork

node = LocalComputeNode(node_id="node-001")
network = DistributedNetwork()
network.register_node(node)

Memory (hanzo-memory)

Persistent memory and RAG backed by SQLite, with optional vector search (sqlite-vec, lancedb, kuzu). Global state lives in ~/.hanzo/; per-project state in .hanzo/.

from hanzo_memory import MemoryService

memory = MemoryService()
await memory.store("key", "value")
result = await memory.retrieve("key")

Development

This is a uv workspace.

git clone https://github.com/hanzoai/python-sdk.git
cd python-sdk
uv sync --all-packages       # install the whole workspace

uv run pytest tests/ -v      # run tests
make lint                    # ruff lint
make format                  # ruff format
make type-check              # mypy / pyright

Per-package work:

uv run pytest pkg/hanzo-mcp -v
cd pkg/hanzo && uv build

Configuration

HANZO_API_KEY=your-api-key
HANZO_BASE_URL=https://api.hanzo.ai
HANZO_LOG_LEVEL=INFO

Or ~/.hanzo/config.yaml:

api:
  key: your-api-key
  base_url: https://api.hanzo.ai
logging:
  level: INFO

Security

  • Transport is TLS 1.3+. Secrets belong in a KMS, never in source or plaintext.
  • SOC 2 audit in progress; HIPAA BAA available.

Report vulnerabilities to [email protected]. See SECURITY.md.

Contributing

Contributions welcome — see CONTRIBUTING.md. Use type hints, add tests for new behavior, and run make lint before opening a PR.

License

Apache License 2.0 — see LICENSE.

Support

Hanzo — the Open AI Cloud

Open source · every language · on-chain settlement. hanzo.ai · docs.hanzo.ai

SDKs in every language — Python (flagship) · TypeScript · Go · Rust · C++ · Swift · Kotlin · umbrella

S
Description
No description provided
Readme Apache-2.0
76 MiB
Languages
Python 99.9%