nemo_gym.sandbox.agent_tools

Endpoint and authenticated MCP helpers for dedicated sandboxed agents.

Module Contents

Functions

Name	Description
`_reachable_host`	-
`restricted_network_policy`	Fail closed when a provider or endpoint cannot support network isolation.
`sandbox_server_url`	Preserve inherited networking; reject loopback binds for remote sandboxes.
`seed_mcp_servers`	Seed host-side tools; pass only per-session MCP authentication into the sandbox.
`verify_agent_response`	Let the verifier own score fields, retaining failed generations for inspection.

API

nemo_gym.sandbox.agent_tools._reachable_host(
    url: str
) -> str

nemo_gym.sandbox.agent_tools.restricted_network_policy(
    provider_name: str,
    urls: list[str]
) -> dict[str, object]

Fail closed when a provider or endpoint cannot support network isolation.

nemo_gym.sandbox.agent_tools.sandbox_server_url(
    name: str,
    require_reachable: bool = False
) -> str

Preserve inherited networking; reject loopback binds for remote sandboxes.

nemo_gym.sandbox.agent_tools.seed_mcp_servers(
    client: nemo_gym.server_utils.ServerClient,
    servers: list[nemo_gym.config_types.ResourcesServerRef],
    body: nemo_gym.base_resources_server.BaseRunRequest,
    cookies: collections.abc.Mapping[str, str],
    timeout_s: float,
    require_reachable: bool = False
) -> dict[str, dict[str, object]]

async

Seed host-side tools; pass only per-session MCP authentication into the sandbox.

nemo_gym.sandbox.agent_tools.verify_agent_response(
    client: nemo_gym.server_utils.ServerClient,
    server: nemo_gym.config_types.ResourcesServerRef,
    body: nemo_gym.base_resources_server.BaseRunRequest,
    response: nemo_gym.openai_utils.NeMoGymResponse,
    cookies: collections.abc.Mapping[str, str],
    force_zero_reward: bool
) -> dict[str, typing.Any]

async

Let the verifier own score fields, retaining failed generations for inspection.