Python: sample external content gate around an approved text-fetch tool #9014

Proposal

Add a focused Python FunctionMiddleware sample that checks the destination of one exact operator-approved HTTPS text-fetch URL, then inspects its complete result before another model call. It would live in python/samples/02-agents/middleware/ismalicious_content_gate.py, with a README entry and credential-free sample tests. No framework API, provider implementation, dependency set, or function-calling loop changes are proposed.

The example calls IsMalicious GET /gate/url before call_next() and POST /gate/scan after it. block and warn refuse release by default; an explicit operator option can release warn. HTTP/quota/timeout/schema failures and incomplete link inspection stop the run. The middleware replaces context.result with a fixed withholding message before MiddlewareTermination, because termination can otherwise preserve an already-produced result.

A local implementation is ready for review. Its 33 tests run the actual Agent function-calling loop and middleware layers with simulated HTTP and model responses. They cover ordering, no next model call after refusal, withholding in result/session, unchanged allowed text, exact original URL encoding, unknown link reputation, serialized body limits, invalid UTF-8 and credential-free decision logs. Ruff and the repository's relaxed sample Pyright configuration pass for the new files.

Scope and service disclosure

This is an external-service sample submitted from the IsMalicious project, prepared with AI assistance. Scans transmit the selected document's full text and URL to https://api.ismalicious.com and use its separate scan quota; credentials are required for a live run. Allowed content is retained unchanged. allow is not proof that content is benign, and the service currently maps unknown link reputation to allow.

The example covers one exact selected local tool, an exact operator-approved public URL and matching hostname, non-streaming Agent.run(), and complete UTF-8 text/plain or text/html results. MCP and provider-executed tools, binary/arbitrary object results and incremental results are explicitly outside its tested scope. No real API keys, external model calls or detector-accuracy claims are involved in the tests.

I intend to submit the prepared sample as a draft for feedback, following the middleware sample channel used by #6528. Please advise whether this scope and sample location fit the project before a maintainer considers merging it.