langchain - 💡(How to fix) Fix Community integration: x-agent-trust signing for LangChain tool calls (xat-langchain) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
langchain-ai/langchain#36682Fetched 2026-04-13 05:35:28
View on GitHub
Comments
1
Participants
2
Timeline
3
Reactions
0
Timeline (top)
closed ×1commented ×1labeled ×1

Code Example

pip install xat-langchain

---

from xat_langchain import XATToolkit

toolkit = XATToolkit(key_file="agent.pem", agent_id="my-agent")
signed_tools = toolkit.wrap(existing_tools)

# Every HTTP call these tools make now carries Agent-Signature
agent = create_react_agent(llm, signed_tools)
RAW_BUFFERClick to expand / collapse

Built a LangChain integration for the x-agent-trust extension (recently registered in the OpenAPI Extensions Registry). It wraps tool calls so every outbound HTTP request carries a signed Agent-Signature header.

Install:

pip install xat-langchain

Usage:

from xat_langchain import XATToolkit

toolkit = XATToolkit(key_file="agent.pem", agent_id="my-agent")
signed_tools = toolkit.wrap(existing_tools)

# Every HTTP call these tools make now carries Agent-Signature
agent = create_react_agent(llm, signed_tools)

Also supports AWS KMS for production deployments where the private key never leaves the HSM.

What it does:

  • Signs every tool HTTP request with ECDSA P-256 (ES256)
  • Canonical request includes body hash (tamper-evident)
  • Timestamp in bounded window (replay protection)
  • XATCallbackHandler provides an audit trail of signed calls

Links:

Happy to take feedback on the approach.

extent analysis

TL;DR

To integrate the x-agent-trust extension with LangChain, install the xat-langchain package and use the XATToolkit to wrap existing tools, ensuring every outbound HTTP request carries a signed Agent-Signature header.

Guidance

  • Verify the installation of the xat-langchain package using pip install xat-langchain.
  • Ensure the agent.pem file and agent_id are correctly configured when creating an instance of XATToolkit.
  • Review the usage example to correctly wrap existing tools and create a React agent with signed tools.
  • Consider using AWS KMS for production deployments to keep the private key secure within the HSM.

Example

from xat_langchain import XATToolkit

# Assuming 'agent.pem' and 'my-agent' are the correct key file and agent ID
toolkit = XATToolkit(key_file="agent.pem", agent_id="my-agent")
signed_tools = toolkit.wrap(existing_tools)

Notes

The provided information focuses on the installation and usage of the xat-langchain package. Without specific error messages or issues, it's challenging to provide a more targeted solution. Ensure that all dependencies and configurations are correct, and review the documentation for any updates or known issues.

Recommendation

Apply the workaround by verifying the correct installation and configuration of the xat-langchain package, as this is the most straightforward step to resolve potential integration issues with the x-agent-trust extension.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

langchain - 💡(How to fix) Fix Community integration: x-agent-trust signing for LangChain tool calls (xat-langchain) [1 comments, 2 participants]