AssistantAgent a model, instructions,
and tools; AutoGen runs the model-calling loop — and, with RoundRobinGroupChat /
SelectorGroupChat, coordinates teams of agents that hand off until a termination
condition is met.
- What AutoGen ships — agents, the model loop, multi-agent teams and handoff,
termination conditions, streaming/
Console, and first-class MCP support viaMcpWorkbenchandmcp_server_tools. - What it doesn’t ship — a way for those agents to act as a real account: sign up for a SaaS tool, hold a funded card, or spend within a budget you control, per end-user.
How the pairing works
- AutoGen has first-class MCP support via
McpWorkbench— point it at any MCP server and its tools are discovered and exposed to your agents automatically (no manual schema wiring). - Naive ships a hosted MCP server and mints per-user sessions — short-lived, revocable endpoints whose tool list is the fused native + third-party toolset, already filtered by that user’s Account Kit.
- Each session is one URL + one bearer scoped to one user. Build an
McpWorkbenchfrom it, hand it to an agent (or a whole team) for one run, and every tool call runs as that user — gated server-side.
Tested against:
autogen-agentchat 0.7.x and autogen-ext 0.7.x with the
[openai,mcp] extras (AssistantAgent, RoundRobinGroupChat, TextMentionTermination,
McpWorkbench / SseServerParams from autogen_ext.tools.mcp, and
OpenAIChatCompletionClient), the mcp Python package (SSE transport), and Naive
API v2 (hosted MCP server over SSE + per-user sessions), on Python ≥ 3.10.Naive’s MCP server uses SSE transport — pair it with AutoGen’s SseServerParams
(not StreamableHttpServerParams). MCP support isn’t in AutoGen’s base install: add the
mcp extra (autogen-ext[mcp]). This guide targets the 0.4+ API line
(autogen-agentchat / autogen-ext) — the legacy pyautogen 0.2 API is different. There
is no Python Naive SDK yet — provision the control plane over the REST API, the
dashboard, the CLI, or the Node SDK (@usenaive-sdk/server).
Pin your versions and set model to one you have access to.Prerequisites
- A Naive API key (
nv_sk_...) — get one from the dashboard. - An
OPENAI_API_KEYfor the model that runs the agent (or swap in any otherautogen-extmodel client). - Python ≥ 3.10.
Minimal viable integration
The shortest path to an AutoGen agent that can actually transact: define a policy and provision a user (control plane, once), then at runtime mint a per-user MCP session and hand it to the agent.Define the policy, then provision a user
An Account Kit is the spend/capability policy. Here a tenant
user gets a card (capped at $500, approval required), the vault, and an allowlist of apps.
Everything the agent does is bounded by this kit — server-side. These are one-time
control-plane calls:
Mint a per-user MCP session
At runtime, mint a short-lived session for the user. It returns the scoped
SSE endpoint and a bearer that lives in the headers — never in the URL — and expires (default
15 min, max 24h):
Build the agent — and let it transact
Point AutoGen’s The model discovers GitHub, returns a connect link for Alice to authorize, and attempts to
issue the card — a real card on Alice’s account, capped by her kit. The whole agent loop
is AutoGen’s; the real-world actions are Naive’s.
McpWorkbench at the session’s scoped SSE endpoint, attach it to an
AssistantAgent, and stream the run. AutoGen discovers Naive’s tools and runs the multi-step
loop for you (call tool → feed result back → continue):Extension: human-in-the-loop spend
Because the kit setcards.requiresApproval: true, the agent cannot silently spend.
You get two complementary layers — pair them for defense in depth:
- In the conversation — drop a
UserProxyAgentinto the team so a human is asked to confirm before the team continues. - On the server — even if a call gets through, Naive freezes it and returns a pending
approval (HTTP
202) instead of a live card. This holds no matter what runtime calls it.
A
UserProxyAgent (or a TextMentionTermination("APPROVE") gate that pauses the team) is a
UX / early-interrupt convenience — it shapes the conversation, not the account. The real
enforcement is Naive’s server-side approval gate below, which applies regardless of prompt or
agent configuration.202 response uses action; approval records from the approvals API use
action_type.
Your app then resolves it out of band — and on approval, Naive replays the frozen action
server-side:
pending → executed / failed / denied) and the deny endpoint.
Approvals are only enforced for agent (API-key / MCP) calls on real tenant users. A human
acting in your dashboard, and agent calls on the operator’s own default user, bypass the
gate — so end-user agents stay governed while your own automation isn’t slowed down.
A multi-agent team that transacts
AutoGen’s signature is teams: several agents that plan, critique, and hand off until the job is done. Keep that — and let only the operator agent hold Naive’s per-user toolset. The planner reasons in plain text; the operator is the one with a real account, still bounded by the same Account Kit and approval gate:McpWorkbench from it. The agents
and instructions stay identical — only which user’s session backs the operator’s tools
changes, and every call is Account-Kit-gated server-side. Revoke a session early with
DELETE /v1/users/{user_id}/sessions/{id}.
What stays enforced
No matter which path you choose, the policy is enforced where it matters — on Naive’s servers, not in your prompt or your agents:- Identity — every action runs as a specific tenant user, fully isolated from your other users.
- Capability bounds — the Account Kit decides which
primitives and which apps the agent can touch (
allowlist/blocklist/ per-tool). - Scoped spend — virtual cards are capped per card and per user; the model can’t raise its own limit.
- Human-in-the-loop — sensitive actions (cards, domains, KYC, formation, connecting an app) freeze as approvals until a human says yes.
Next steps
- SDK overview — the full Naive client surface
- Sessions — per-user MCP sessions for any MCP-aware runtime
- Account Kits — author spend/capability policy
- Approvals — the human-in-the-loop lifecycle
- MCP server — how Naive’s hosted MCP server works