Add opt-in Defender real-time protection client - #277
Open
Krishnadheeraj (DheerajPannala) wants to merge 1 commit into
Open
Krishnadheeraj (DheerajPannala) wants to merge 1 commit into
Krishnadheeraj (DheerajPannala) wants to merge 1 commit into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Krishnadheeraj (DheerajPannala)
requested review from
Pujarini Mohapatra (biswapm) and
jaganp (jaganp-microsoft)
and
a lite review from Copilot
September 1, 2026 12:53
Copilot started reviewing on behalf of
Krishnadheeraj (DheerajPannala)
September 1, 2026 12:53
View session
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const tokenB = createToken({ azp: 'customer-b' }); | ||
| const fetchImplementation = jest.fn<typeof fetch>( | ||
| async (url, init) => { | ||
| if (String(url).includes('login.microsoftonline.com')) { |
| await client.evaluateToolRequest(toolRequest, customerA); | ||
|
|
||
| const tokenCalls = fetchImplementation.mock.calls | ||
| .filter(([url]) => String(url).includes('login.microsoftonline.com')); |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an opt-in Microsoft Defender real-time protection (RTP) client to the tooling package, enabling four lifecycle inspection points (agent request/response and tool request/response) with optional enforcement and fail-open/fail-closed behavior, plus documentation and integration scripts for live verification. Also updates observability startup to apply all “simplified options” consistently.
Changes:
- Introduces
DefenderRtpClient+ contracts and exports it from@microsoft/agents-a365-tooling. - Extends
ToolingConfigurationwith Defender RTP configuration (endpoint required when enabled, timeout/max-content limits, fail-closed toggle). - Adds unit tests + live demo/smoke scripts and updates
ObservabilityManager.start()to pass through exporter/logger/namespace options.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/tooling/integration/defender-rtp-live-smoke.mjs | Live smoke script to validate Defender RTP behavior against a real endpoint using env-provided auth. |
| tests/tooling/integration/defender-rtp-agent-demo.mjs | Live demo script showing a benign turn and a blocked tool call before execution. |
| tests/tooling/defender-rtp-client.test.ts | Unit tests covering Defender RTP request/response shaping, enforcement behavior, and token flows/caching. |
| tests/tooling/configuration/DefenderRtpConfiguration.test.ts | Unit tests validating new ToolingConfiguration Defender RTP defaults and overrides. |
| tests/observability/core/observabilityBuilder-configProvider.test.ts | Updates test coverage for ObservabilityManager.start() simplified option wiring. |
| packages/agents-a365-tooling/src/index.ts | Exposes the new defender module from the tooling package public API. |
| packages/agents-a365-tooling/src/defender/index.ts | Barrel export for Defender RTP client + contracts. |
| packages/agents-a365-tooling/src/defender/DefenderRtpClient.ts | Implements the opt-in Defender RTP client, enforcement helpers, request building, and token acquisition/caching. |
| packages/agents-a365-tooling/src/defender/contracts.ts | Defines the Defender RTP request/auth/result contracts. |
| packages/agents-a365-tooling/src/configuration/ToolingConfigurationOptions.ts | Adds configuration override hooks for enabling Defender RTP and controlling endpoint/scope/timeout/fail mode/max content. |
| packages/agents-a365-tooling/src/configuration/ToolingConfiguration.ts | Implements env + override resolution for Defender RTP configuration, including “endpoint required when enabled”. |
| packages/agents-a365-tooling/README.md | Documents Defender RTP usage, configuration, enforcement semantics, and live verification scripts. |
| packages/agents-a365-observability/src/ObservabilityManager.ts | Ensures start() applies exporter options, service namespace, and custom logger in the simplified API. |
| package.json | Adds smoke:defender-rtp and demo:defender-rtp scripts that build needed workspaces then run the live scripts. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+29
to
+36
| function createToken(extraClaims: Record<string, unknown> = {}): string { | ||
| const payload = Buffer.from(JSON.stringify({ | ||
| exp: Math.floor(Date.now() / 1000) + 3600, | ||
| roles: ['AIAgentsRTP.ToolInvocation'], | ||
| ...extraClaims, | ||
| })).toString('base64url'); | ||
| return `e30.${payload}.signature`; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation