Python: OpenAI Agents SDK

# securd_guard.py
# Held and blocked names resolve to the policy's block page address.
# Put that address (from the console, Sites > your site) in SECURD_BLOCK_ADDRS.
import os
import socket
import logging

SECURD_BLOCK_ADDRS = {a for a in os.getenv("SECURD_BLOCK_ADDRS", "").split(",") if a}
log = logging.getLogger("securd")


class SecurdHeld(Exception):
    """Destination is held at the Greywall or blocked by the policy for this agent role."""


def securd_guard(hostname: str, agent_role: str) -> None:
    try:
        answers = {info[4][0] for info in socket.getaddrinfo(hostname, 443)}
    except socket.gaierror as exc:
        log.warning("securd.unresolved", extra={"agent_role": agent_role, "host": hostname})
        raise SecurdHeld(f"{hostname} did not resolve inside {agent_role}") from exc
    if answers & SECURD_BLOCK_ADDRS:
        log.warning("securd.held", extra={"agent_role": agent_role, "host": hostname})
        raise SecurdHeld(f"{hostname} is held or blocked for {agent_role}")

from urllib.parse import urlparse
import httpx
from agents import Agent, function_tool
from securd_guard import securd_guard, SecurdHeld

AGENT_ROLE = "support-agent"

@function_tool
def call_api(url: str) -> str:
    """Call an approved API endpoint."""
    host = urlparse(url).hostname or ""
    try:
        securd_guard(host, AGENT_ROLE)
    except SecurdHeld as held:
        return f"BLOCKED: {held}"
    return httpx.get(url, timeout=20).text[:4000]

agent = Agent(name="support", instructions="Use only approved tools.", tools=[call_api])