feat(aiguard): evaluate openai-agents MCP server tool calls

.cursor/rules/ai-guard.mdc

@@ -77,7 +77,9 @@ ddtrace/aiguard/
     ├── _anthropic_streaming.py # Anthropic stream reconstruction
     ├── _anthropic_errors.py    # Anthropic-compatible abort error class
     ├── _langchain.py       # LangChain agent/chatmodel/llm listeners
-    └── _mcp.py             # MCP metadata builder, OpenAI MCP approval decision cache
+    ├── _mcp.py             # MCP metadata builder, model tool-call registry (real call
+    │                       #   IDs + conversation), OpenAI MCP approval decision cache
+    └── _openai_agents.py   # openai-agents MCP server tool listeners
 ```
 
 The old import path `ddtrace.appsec.ai_guard` remains as a deprecated re-export
@@ -137,6 +139,7 @@ Events currently consumed:
 | OpenAI (stream wrappers) | `openai.patch` / `.unpatch` |
 | Anthropic | `anthropic.messages.create.before` / `.after`, `anthropic.patch` / `.unpatch` |
 | LangChain | `langchain.{chatmodel,llm}.{generate,agenerate,stream}.before` / `.finally`, `langchain.{chatmodel,llm}.stream.started`, `langchain.patch` / `.unpatch` |
+| openai-agents MCP (opt-in, DD_AI_GUARD_COLLECT_MCP_ENABLED) | `openai_agents.mcp.invoke_tool.before`, `openai_agents.mcp.call_tool.before` |
 | HTTP (client IP) | `set_http_meta_for_asm` |
 
 ### 3. Provider converters → canonical `Message` shape

.riot/requirements/127d746.txt

@@ -0,0 +1,54 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+colorama==0.4.6
+coverage[toml]==7.16.2
+cryptography==50.0.2
+distro==1.9.0
+griffe==1.15.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==1.30.0
+mock==5.2.0
+openai==1.99.9
+openai-agents==0.0.19
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pydantic-settings==2.15.0
+pygments==2.21.0
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-dotenv==1.2.4
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==2026.9.1
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+tqdm==4.70.1
+types-requests==2.33.0.20260906
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0

.riot/requirements/189d47d.txt

@@ -0,0 +1,54 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+colorama==0.4.6
+coverage[toml]==7.16.2
+cryptography==50.0.2
+distro==1.9.0
+griffe==1.15.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==1.30.0
+mock==5.2.0
+openai==1.99.9
+openai-agents==0.0.19
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pydantic-settings==2.15.0
+pygments==2.21.0
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-dotenv==1.2.4
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==2026.9.1
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+tqdm==4.70.1
+types-requests==2.33.0.20260906
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0

.riot/requirements/198d9ea.txt

@@ -0,0 +1,52 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+coverage[toml]==7.16.2
+cryptography==50.0.2
+griffelib==2.3.0
+h11==0.16.0
+httpcore2==2.13.1
+httpx2==2.13.1
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==2.3.0
+mcp-types==2.3.0
+mock==5.2.0
+openai==3.24.0
+openai-agents==0.23.1
+opentelemetry-api==1.45.0
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pygments==2.21.0
+pyjwt==2.15.1
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==2026.9.1
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+truststore==0.10.4
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0
+websockets==16.1.1

.riot/requirements/1bb3879.txt

@@ -0,0 +1,56 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+colorama==0.4.6
+coverage[toml]==7.16.2
+cryptography==50.0.2
+distro==1.9.0
+exceptiongroup==1.3.1
+griffe==1.15.0
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==1.30.0
+mock==5.2.0
+openai==1.99.9
+openai-agents==0.0.19
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pydantic-settings==2.15.0
+pygments==2.21.0
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-dotenv==1.2.4
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==0.30.0
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+tomli==2.4.1
+tqdm==4.70.1
+types-requests==2.33.0.20260906
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0

.riot/requirements/53d094a.txt

@@ -0,0 +1,52 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+coverage[toml]==7.16.2
+cryptography==50.0.2
+griffelib==2.3.0
+h11==0.16.0
+httpcore2==2.13.1
+httpx2==2.13.1
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==2.3.0
+mcp-types==2.3.0
+mock==5.2.0
+openai==3.24.0
+openai-agents==0.23.1
+opentelemetry-api==1.45.0
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pygments==2.21.0
+pyjwt==2.15.1
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==2026.9.1
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+truststore==0.10.4
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0
+websockets==16.1.1

.riot/requirements/63221c8.txt

@@ -0,0 +1,53 @@
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.5.0
+coverage[toml]==7.16.2
+cryptography==50.0.2
+griffelib==2.3.0
+h11==0.16.0
+httpcore2==2.13.1
+httpx2==2.13.1
+hypothesis==6.45.0
+idna==3.20
+iniconfig==2.3.0
+jiter==0.17.0
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+mcp==2.3.0
+mcp-types==2.3.0
+mock==5.2.0
+openai==3.24.0
+openai-agents==0.23.1
+opentelemetry-api==1.45.0
+opentracing==2.4.0
+packaging==26.3
+pluggy==1.6.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pygments==2.21.0
+pyjwt==2.15.1
+pyjwt[crypto]==2.15.1
+pytest==8.4.2
+pytest-asyncio==0.23.7
+pytest-cov==7.1.0
+pytest-mock==3.16.0
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rpds-py==2026.9.1
+sniffio==1.3.1
+sortedcontainers==2.4.0
+sse-starlette==3.5.0
+starlette==1.7.0
+tomli==2.4.1
+truststore==0.10.4
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+urllib3==2.8.0
+uvicorn==0.54.0
+websockets==16.1.1