Agent Registry — Agno

Wire a LumoAuth-registered agent into Agno. The agent's identity is its registered AGENT_CLIENT_ID in LumoAuth; it authenticates via OAuth 2.0 client credentials (the LumoAuthAgent class handles this); tools call has_capability(...) before executing; for an MCP (Model Context Protocol, the standard way agents call tool servers) tool call, the code swaps the base access token for one bound to the target MCP server via token exchange.

Prerequisites

Install the lumoauth package and set the environment variables LUMOAUTH_URL, LUMOAUTH_ORG_ID, AGENT_CLIENT_ID, and AGENT_CLIENT_SECRET. See Install the SDK.

Install

pip install lumoauth agno openai

Example

from agno.agent import Agent
from agno.tools import tool
from agno.models.openai import OpenAIChat
from lumoauth import LumoAuthAgent

# 1. Initialize and authenticate the LumoAuth Agent
lumo_agent = LumoAuthAgent()
lumo_agent.authenticate()

# 2. Define tools that check LumoAuth capabilities
@tool
def search_company_documents(query: str) -> str:
    """Search internal company documents for the given query."""
    if not lumo_agent.has_capability('read:documents'):
        return "Error: Agent lacks 'read:documents' capability."
    return f"Found 3 documents matching '{query}'"

@tool
def query_financial_mcp(metric: str) -> str:
    """Query the secured financial metrics MCP server for a given metric."""
    if not lumo_agent.has_capability('mcp:financial'):
        return "Error: Agent lacks 'mcp:financial' capability."
    mcp_token = lumo_agent.get_mcp_token("urn:mcp:financial-data")
    if not mcp_token:
        return "Error: Failed to obtain token for Financial MCP server."
    return f"Retrieved {metric}: $1.2M (Authenticated via MCP Token Exchange)"

# 3. Check budget before running
if lumo_agent.is_budget_exhausted():
    raise RuntimeError("Agent budget exhausted for today.")

# 4. Create and run the Agno Agent
agent = Agent(
    name="Research Analyst",
    model=OpenAIChat(id="gpt-4"),
    tools=[search_company_documents, query_financial_mcp],
    instructions=[
        "You are a senior analyst at a financial firm.",
        "Use tools to search documents and query financial metrics.",
    ],
    markdown=True,
)

agent.print_response(
    "Search documents for Q3 performance, then query the financial MCP for EBITDA."
)

How it works

Step	What happens
`LumoAuthAgent()`	Reads credentials from env vars and initializes the client
`lumo_agent.authenticate()`	Runs the OAuth 2.0 client-credentials flow
`has_capability(...)`	Guards tool execution with LumoAuth capability checks
`get_mcp_token(...)`	Swaps the agent token for an MCP-specific token (token exchange)
`is_budget_exhausted()`	Prevents the Agno run if the agent's daily budget is spent

Next steps

Agent Registry overview — manage registrations, budgets, and capabilities
JIT Permissions — Agno — add just-in-time permission escalation

Standards used on this page

Plain name	Standard
Token exchange (delegation)	RFC 8693

See the standards reference for what each one covers and how LumoAuth uses it.

Install​

Example​

How it works​

Next steps​

Standards used on this page​

Install

Example

How it works

Next steps

Standards used on this page