[JVQ (hexablob)]

Community example

Following the maintainer’s scope decision in #9014, this example is now available in hexablob/ismalicious-agent-framework-example, with locked released dependencies, 43 credential-free tests and passing public CI. A community documentation link has been proposed in the issue. This core-samples PR remains closed.

---

Motivation & Context

A selected text-fetch tool can return external instructions directly into the next model request. This sample shows deterministic middleware at both boundaries: destination reputation before fetching, then a complete text scan before releasing the result.

Fixes #9014. This contribution requests feedback on a sample-only external-service integration; it adds no framework APIs or provider/core changes.

Description & Review Guide

• What are the major changes? One self-contained FunctionMiddleware sample, a README entry, and 43 credential-free tests using the actual Agent function-calling and middleware layers with fake HTTP/model transports.
• What is the impact of these changes? block, default warn, service/schema errors and incomplete inspection withhold the current result and stop the next model call. Allowed text remains unchanged. Shared operator URL-scope validation precedes both external HTTP boundaries. Inner result transforms are scanned, and graceful-stop responses are reported as stopped. URLs and full selected text are sent to IsMalicious and use its separate scan quota.
• What do you want reviewers to focus on? Exact URL authorization before any gate/fetch request, bounded decision-only metadata, and replacement of context.result before MiddlewareTermination. MCP/provider-executed tools, incremental results, binary/object results and streaming agent runs are outside the tested scope. Unknown link reputation is retained, and allow is not described as proof of benign content.

Ruff check/format and Pyright with the repository sample profile pass for both new Python files. The native pre-commit hooks for the corrected sample and all 43 new sample cases pass locally. Repository workflows on the latest commit require maintainer authorization; live Foundry/IsMalicious calls and the full repository test suite have not been run.

Disclosure: submitted from the IsMalicious project with AI assistance. This sample uses an external service with required credentials; no real credentials or detector-accuracy claims are included. Maintainer feedback on the sample and its documented scope is welcome.

Related Issue

Fixes #9014

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change.

[Copilot]

Copilot review overview

🟡 Changes recommended

URL authorization, middleware composition, and termination-status issues weaken the documented security boundary.

Review effort: Balanced
Findings: 1

Open (1)

• Validate URL scope before reputation lookup · New

What changed in this PR

Adds an IsMalicious-backed middleware sample that gates an approved text-fetch tool before and after execution.

Changes:

• Adds destination and content scanning middleware.
• Adds 31 credential-free integration tests.
• Documents setup, security behavior, and limitations.

File	Description
python/​samples/​02-agents/​middleware/​ismalicious_content_gate.py	Implements the content gate sample.
python/​tests/​samples/​middleware/​test_ismalicious_content_gate.py	Tests middleware behavior and failure cases.
python/​samples/​02-agents/​middleware/​README.md	Documents usage and security considerations.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[JVQ (hexablob)]

@microsoft-github-policy-service agree [company="N/A"]
@microsoft-github-policy-service agree

[JVQ (hexablob)]

@microsoft-github-policy-service agree

[JVQ (hexablob)]

Fixed the pyupgrade3.21.2 hook finding in signed commit c0538bf. All targeted upstream hooks and the 43 native sample tests pass locally. The sample’s scope and fail-closed policy are unchanged. Six workflows on the new head require fork authorization before their jobs can run. Could a maintainer approve those workflows so the checks can verify this correction? The PR remains ready for review; no authenticated production or billed-model test is claimed.