RagLeap Integrations v0.4.0: UTCP Tools with Allowlisting, Approval, and Bounded HTTPS

AI agents need tools to interact with external systems.

But tool discovery and execution introduce security questions:

  • Which tools can an agent access?
  • Which HTTP methods are permitted?
  • Which origins are trusted?
  • Does every tool call require approval?
  • Can a request redirect somewhere unexpected?
  • What happens when a remote manual contains unsupported fields?

In RagLeap Integrations v0.4.0, we added a UTCP client with explicit tool allowlisting, origin validation, approval checks, and bounded HTTPS transport.

Release: https://github.com/ragleap/ragleap-core/releases/tag/ragleap-integrations-v0.4.0

What is included?

This release introduces:

  • UTCP manual discovery
  • Exact tool allowlisting
  • Approved-origin checks
  • Approval callbacks and pre-approved tools
  • GET, POST, PUT, DELETE, and PATCH transport support
  • Bounded HTTPS requests
  • Discovery reports with skipped-entry reasons

The implementation is intentionally limited to supported HTTP templates rather than accepting arbitrary remote tool definitions.

1. Connect to a UTCP manual

The new connect_utcp() API discovers tools from a UTCP manual.

from ragleap_integrations import connect_utcp connection = connect_utcp( url="https://example.com/utcp-manual.json", allow=["search", "lookup"], )

This is an illustrative example. Replace the URL and tool names with a manual and tools you control.

The connection exposes:

  • tools
  • toolkit
  • skipped
  • report

The allowlist is explicit. The client does not automatically expose every tool found in the manual.

The manual is read once for discovery, creating a snapshot of the definitions used by that connection.

2. Restrict supported HTTP methods

The bounded HTTPS transport supports five methods:

GET POST PUT DELETE PATCH

The existing https_post() function remains a thin wrapper over the expanded transport.

For UTCP HTTP templates, supported parameters are handled according to the implementation's defined rules:

  • URL path parameters are encoded
  • body_field is used for JSON request bodies
  • Other supported fields are sent as query parameters

Unsupported template types and unexpected fields are rejected or skipped with a reason.

This is intentionally not a general-purpose template interpreter.

3. Validate destinations

The UTCP client checks approved origins during discovery and again during execution.

Approved origins include the manual origin and explicitly owner-listed origins.

The bounded transport also applies network protections:

  • Public-address validation
  • IP pinning
  • Verified TLS
  • Redirect blocking
  • Response-size caps
  • Request deadlines

Unsupported methods are rejected before DNS resolution.

These checks reduce the chance that a tool definition can turn an otherwise controlled integration into an unrestricted outbound request.

They do not make every remote server safe or eliminate all network risks.

4. Apply approval policy

Each UTCP tool requires approval unless it is explicitly pre-approved.

The API supports an approval callback, pre-approved tools, and event callbacks.

This provides an application-level decision point before a tool executes.

A useful distinction:

Allowlisting determines which tools are available.

Origin validation determines where the request may go.

Approval determines whether a particular tool call may proceed.

These controls complement one another; none replaces the others.

5. Unsupported features are explicit

The current integration does not support:

  • OpenAPI conversion
  • OAuth or UTCP authentication blocks
  • header_fields
  • Variable substitution
  • Environment lookups
  • Multi-tenant UTCP hubs
  • Arbitrary template types

It also rejects non-UTCP manuals.

Unsupported entries are reported with skip reasons instead of being silently treated as valid tools.

Remote manuals, tool descriptions, and response text should still be treated as untrusted input. The integration does not claim to screen server content for prompt injection.

6. Testing

The release reports 545 verified tests.

Check Result
Full test suite 545 verified
Without optional ragleap-security 541 passed, 4 skipped
Deliberate break cases 127/127 caught
Transport tests Local TLS server with temporary certificate
Wheel comparison Published wheel byte-identical to TestPyPI
Installed files Compared with source
Dependency check pip check clean
Smoke test Passed

The tests cover the implemented behavior and the tested failure cases. They should not be interpreted as a complete security audit.

We also did not complete a live end-to-end UTCP call against a real server using the current manual format. That remains an interoperability limitation.

7. Install 

pip install ragleap-integrations==0.4.0

8. Try it and review the design

Conclusion

Agent tool integration is not only about exposing more functions.

It is about defining what can be discovered, where requests can go, which actions require approval, and what behavior is bounded.

RagLeap Integrations v0.4.0 adds UTCP support with those constraints in mind—while keeping its limitations and verification status explicit.

AI agents need tool access. They also need boundaries.