feat: Add DNS-AID discovery utilities for multi-agent systems#7205
feat: Add DNS-AID discovery utilities for multi-agent systems#7205Ingmar Van Glabbeek (IngmarVG-IB) wants to merge 4 commits intolangchain-ai:mainfrom
Conversation
Adds dns_aid module to langgraph-prebuilt enabling dynamic agent discovery and publishing via DNS using the DNS-AID protocol (SVCB + TXT records). Key functions: - discover_tools(): find agents via DNS and create invocable tools - discover_agents(): get agent metadata from DNS-AID records - publish_graph() / unpublish_graph(): register/remove graphs in DNS Enables multi-agent LangGraph systems where agents discover collaborators at runtime rather than hardcoding references. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LangGraph node that discovers agents via DNS-AID, filters by required capabilities, ranks specialists over generalists, and dispatches queries. Includes TTL-aware discovery caching and support for LangServe/A2A endpoints. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
This PR has been automatically closed because it does not link to an approved issue. All external contributions must reference an approved issue or discussion. Please:
Maintainers: reopen this PR or remove the |
Mason Daugherty (mdrxy)
added
the
bypass-issue-check
![corridor-security[bot]](https://avatars.githubusercontent.com/in/1177339?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Issues\n- Insecure transport selection (cleartext HTTP) due to port-based scheme logic\nBoth the DNS-AID tool creation and resolver node select the HTTP/HTTPS scheme based solely on whether the port equals 443, ignoring the declared protocol from discovery. If an agent is published as HTTPS on a non-standard port (e.g., 8443), these functions will connect over HTTP in cleartext, exposing user queries and responses to interception or manipulation. This is a realistic risk when integrating third-party/discovered agents and can lead to sensitive data exposure.\n\nRecommendations\n- Derive the scheme from the discovered protocol (e.g., 'https' means HTTPS regardless of port), not the port number.
- Derive HTTP/HTTPS scheme from discovered protocol instead of port number, preventing cleartext connections to HTTPS agents on non-443 ports - Make dns_aid imports lazy in __init__.py to avoid breaking langgraph-prebuilt when dns-aid is not installed - Use consistent 'endpoint' field name across dns_aid.py and dns_aid_node.py (was 'target_host' in node module) - Log exceptions at debug level instead of silently swallowing them - Export DnsAidResolverNode, ResolverResult, resolve_and_dispatch from __init__.py - Add dns-aid and httpx as optional dependencies in pyproject.toml - Fix docstring to show correct StateGraph usage with custom state type
2 participants
Summary
langgraph/prebuilt/dns_aid.pywith DNS-AID discovery utilities for multi-agent systemsdiscover_tools()/discover_agents()query DNS-AID records and create LangChain toolspublish_graph()/unpublish_graph()publish compiled LangGraphs as discoverable agentsNew: DNS-AID resolver node
langgraph/prebuilt/dns_aid_node.py:DnsAidResolverNode— a LangGraph node for capability-filtered agent dispatch/invokeor A2Amessage/sendresolve_and_dispatch()convenience function for one-shot usageStateGraphviaMessagesStatepatternTest plan