Three defects in `hanzo auth login`, found while auditing HIP-0111 compliance.
1. LOGIN DID NOT WORK AT ALL. urllib defaults its User-Agent to
`Python-urllib/3.x`, which Cloudflare refuses in front of hanzo.id with
`error code: 1010` — a 403 that never reaches IAM. The browser leg looked
fine, the user signed in, and THEN the token exchange died, so the failure
landed after the user had already authenticated. Measured on the live host:
POST /v1/iam/oauth/token UA=Python-urllib/3.11 -> 403 (CF 1010)
POST /v1/iam/oauth/token UA=hanzo-cli/python -> 400 (reaches IAM)
POST /v1/iam/oauth/device UA=Python-urllib/3.11 -> 403 (CF 1010)
POST /v1/iam/oauth/device UA=hanzo-cli/python -> 400 (reaches IAM)
Every outbound request now identifies itself. The device flow was dead the
same way.
2. NO PKCE. The flow had zero code_challenge/code_verifier — `state` only,
which is CSRF protection, not interception protection. HIP-0111 Security
Considerations makes PKCE S256 mandatory, and RFC 8252 §8.1 requires it for
native apps specifically: this redirects to a fixed loopback port (1456) that
any local process can bind or race, so an intercepted authorization code was
directly redeemable. Now S256, with the verifier bound into the exchange.
hanzo.id advertises `code_challenge_methods_supported: ["S256"]`.
3. LEGACY PATHS (HIP-0111 §4.4). It called `/oauth/authorize`, `/oauth/token`
and `/api/device/code` — the `/oauth/*` and `/api/*` spellings the standard
retired, the latter breaking the absolute "no /api/" rule. Replaced with the
canonical paths hanzo.id actually advertises in its discovery document, held
in ONE constant block so no call site spells a path itself (§4.3):
/v1/iam/oauth/authorize /v1/iam/oauth/token /v1/iam/oauth/device
`/api/device/code` was not merely non-canonical — it answers 401; the real
device endpoint is `/v1/iam/oauth/device`, per discovery.
Also drops a redundant function-local `import base64` now that the module
imports it.
Hanzo Python SDK
The flagship Python SDK for the Open AI Cloud — models, agents, tools, memory, and MCP in one install.
This is the most complete Hanzo SDK — a uv workspace of 60+ composable packages
covering the full AI surface: the typed cloud client, an agent framework, the
Model Context Protocol server and tools, persistent memory + RAG, distributed
compute, and a batteries-included CLI. If you build AI in Python, start here.
Install
pip install hanzo # flagship: CLI + agents + MCP + client
Or install exactly what you need:
pip install hanzoai # just the typed cloud API client
pip install "hanzo[all]" # everything, including optional extras
Quickstart
from hanzoai import ApiClient, Configuration, AiOpenAICompatibleApi
from hanzoai import AiChatCompletionRequest, AiChatMessage
config = Configuration(host="https://api.hanzo.ai", access_token="sk-...")
with ApiClient(config) as client:
ai = AiOpenAICompatibleApi(client)
resp = ai.ai_create_chat_completion(
AiChatCompletionRequest(
model="zen-coder",
messages=[AiChatMessage(role="user", content="Ship it.")],
)
)
print(resp.choices[0].message.content)
Every route is https://api.hanzo.ai/v1/<service>/*. Models come from the Zen
family (our own models) plus any provider you connect — one typed client, no proxy
in the middle.
Packages
The workspace splits cleanly by concern. The headline packages:
| Package | Purpose |
|---|---|
hanzoai |
Typed cloud API client (generated from the Hanzo OpenAPI surface). |
hanzo |
The hanzo CLI + runtime that ties everything together. |
hanzo-mcp |
Model Context Protocol server — discovers tools via entry points. |
hanzo-agents / hanzo-agent |
Agent framework — build and orchestrate agents and swarms. |
hanzo-network |
Distributed AI compute and node orchestration. |
hanzo-memory |
Persistent memory + RAG (SQLite, optional vector backends). |
hanzo-tools-* |
60+ single-concern tool packages (shell, browser, fs, code, vector, iam, …), each exposing a TOOLS list. |
python-sdk/
└── pkg/
├── hanzoai/ # typed cloud client (OpenAPI-generated)
├── hanzo/ # CLI + runtime meta package
├── hanzo-mcp/ # MCP server (entry-point tool discovery)
├── hanzo-agents/ # agent framework
├── hanzo-network/ # distributed compute
├── hanzo-memory/ # memory + RAG
└── hanzo-tools-*/ # composable tool packages
CLI
pip install hanzo gives you the hanzo command:
hanzo chat # chat with the Zen models
hanzo node # start / manage a local compute node
hanzo mcp # run the MCP server for your editor or agent
hanzo agent # build and run agents
hanzo run # run a workflow
hanzo cloud # manage cloud resources
hanzo search # AI-powered search
Run hanzo --help for the full command tree.
Model Context Protocol (hanzo-mcp)
hanzo-mcp hosts the MCP server and discovers tools through
[project.entry-points."hanzo.tools"], so any installed hanzo-tools-* package
lights up automatically.
from hanzo_mcp import create_mcp_server
server = create_mcp_server()
server.register_tool(my_tool)
server.start()
Agents (hanzo-agents)
from hanzo_agents import Agent, Swarm
agent = Agent(
name="researcher",
model="zen-coder",
instructions="You are a research assistant.",
)
swarm = Swarm([agent])
result = await swarm.run("Research quantum computing.")
Network (hanzo-network)
from hanzo_network import LocalComputeNode, DistributedNetwork
node = LocalComputeNode(node_id="node-001")
network = DistributedNetwork()
network.register_node(node)
Memory (hanzo-memory)
Persistent memory and RAG backed by SQLite, with optional vector search
(sqlite-vec, lancedb, kuzu). Global state lives in ~/.hanzo/; per-project
state in .hanzo/.
from hanzo_memory import MemoryService
memory = MemoryService()
await memory.store("key", "value")
result = await memory.retrieve("key")
Development
This is a uv workspace.
git clone https://github.com/hanzoai/python-sdk.git
cd python-sdk
uv sync --all-packages # install the whole workspace
uv run pytest tests/ -v # run tests
make lint # ruff lint
make format # ruff format
make type-check # mypy / pyright
Per-package work:
uv run pytest pkg/hanzo-mcp -v
cd pkg/hanzo && uv build
Configuration
HANZO_API_KEY=your-api-key
HANZO_BASE_URL=https://api.hanzo.ai
HANZO_LOG_LEVEL=INFO
Or ~/.hanzo/config.yaml:
api:
key: your-api-key
base_url: https://api.hanzo.ai
logging:
level: INFO
Security
- Transport is TLS 1.3+. Secrets belong in a KMS, never in source or plaintext.
- SOC 2 audit in progress; HIPAA BAA available.
Report vulnerabilities to [email protected]. See SECURITY.md.
Contributing
Contributions welcome — see CONTRIBUTING.md. Use type hints,
add tests for new behavior, and run make lint before opening a PR.
License
Apache License 2.0 — see LICENSE.
Support
- Docs: docs.hanzo.ai
- Issues: github.com/hanzoai/python-sdk/issues
- Email: [email protected]
Hanzo — the Open AI Cloud
Open source · every language · on-chain settlement. hanzo.ai · docs.hanzo.ai
SDKs in every language — Python (flagship) · TypeScript · Go · Rust · C++ · Swift · Kotlin · umbrella