Skip to main content
Microsoft AutoGen is an open-source framework for building agentic systems. You give an AssistantAgent a model, instructions, and tools; AutoGen runs the model-calling loop — and, with RoundRobinGroupChat / SelectorGroupChat, coordinates teams of agents that hand off until a termination condition is met.
  • What AutoGen ships — agents, the model loop, multi-agent teams and handoff, termination conditions, streaming/Console, and first-class MCP support via McpWorkbench and mcp_server_tools.
  • What it doesn’t ship — a way for those agents to act as a real account: sign up for a SaaS tool, hold a funded card, or spend within a budget you control, per end-user.
That’s the half Naive adds. You keep AutoGen’s orchestration; Naive gives each agent a tenant identity, a virtual card, 1,000+ third-party connections, and an Account Kit that bounds exactly what the agent can do — enforced server-side, with human approval on the sensitive actions.

How the pairing works

  • AutoGen has first-class MCP support via McpWorkbench — point it at any MCP server and its tools are discovered and exposed to your agents automatically (no manual schema wiring).
  • Naive ships a hosted MCP server and mints per-user sessions — short-lived, revocable endpoints whose tool list is the fused native + third-party toolset, already filtered by that user’s Account Kit.
  • Each session is one URL + one bearer scoped to one user. Build an McpWorkbench from it, hand it to an agent (or a whole team) for one run, and every tool call runs as that user — gated server-side.
  Microsoft AutoGen (team.run_stream)    Naive
  ───────────────────────────────       ─────
  AssistantAgent ── tool call ──▶ loop
        │  model picks an MCP tool

  McpWorkbench (SSE + scoped bearer) ─▶  /mcp/sse/sess_…   (per-user session)
                                          │  AccountKit-gated, scoped to one user

                                    connect GitHub · issue a $50 card · run a capability

                                    sensitive? → 202 pending_approval (human-in-the-loop)
Tested against: autogen-agentchat 0.7.x and autogen-ext 0.7.x with the [openai,mcp] extras (AssistantAgent, RoundRobinGroupChat, TextMentionTermination, McpWorkbench / SseServerParams from autogen_ext.tools.mcp, and OpenAIChatCompletionClient), the mcp Python package (SSE transport), and Naive API v2 (hosted MCP server over SSE + per-user sessions), on Python ≥ 3.10.Naive’s MCP server uses SSE transport — pair it with AutoGen’s SseServerParams (not StreamableHttpServerParams). MCP support isn’t in AutoGen’s base install: add the mcp extra (autogen-ext[mcp]). This guide targets the 0.4+ API line (autogen-agentchat / autogen-ext) — the legacy pyautogen 0.2 API is different. There is no Python Naive SDK yet — provision the control plane over the REST API, the dashboard, the CLI, or the Node SDK (@usenaive-sdk/server). Pin your versions and set model to one you have access to.

Prerequisites

  • A Naive API key (nv_sk_...) — get one from the dashboard.
  • An OPENAI_API_KEY for the model that runs the agent (or swap in any other autogen-ext model client).
  • Python ≥ 3.10.
pip install -U "autogen-agentchat" "autogen-ext[openai,mcp]" httpx
export NAIVE_API_KEY=nv_sk_live_...
export OPENAI_API_KEY=sk-...

Minimal viable integration

The shortest path to an AutoGen agent that can actually transact: define a policy and provision a user (control plane, once), then at runtime mint a per-user MCP session and hand it to the agent.
1

Define the policy, then provision a user

An Account Kit is the spend/capability policy. Here a tenant user gets a card (capped at $500, approval required), the vault, and an allowlist of apps. Everything the agent does is bounded by this kit — server-side. These are one-time control-plane calls:
# Control plane: a reusable policy template.
curl -X POST https://api.usenaive.ai/v1/account-kits \
  -H "Authorization: Bearer $NAIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Pro",
    "primitives_config": {
      "cards": { "enabled": true, "requiresApproval": true, "defaults": { "spending_limit_cents": 50000 } },
      "vault": { "enabled": true }
    },
    "connections_config": { "mode": "allowlist", "toolkits": ["github", "gmail", "stripe"] }
  }'
# → { "id": "<kit_id>", ... }

# Provision one of your end-users and assign the kit.
curl -X POST https://api.usenaive.ai/v1/users \
  -H "Authorization: Bearer $NAIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "external_id": "user_123", "email": "alice@acme.com", "account_kit_id": "<kit_id>" }'
# → { "id": "<user_id>", ... }
2

Mint a per-user MCP session

At runtime, mint a short-lived session for the user. It returns the scoped SSE endpoint and a bearer that lives in the headers — never in the URL — and expires (default 15 min, max 24h):
import os
import httpx

NAIVE_API = "https://api.usenaive.ai"
AUTH = {"Authorization": f"Bearer {os.environ['NAIVE_API_KEY']}"}

ALICE_USER_ID = "<user_id>"  # from the control-plane step

def mint_session(user_id: str, ttl_ms: int = 15 * 60 * 1000) -> dict:
    r = httpx.post(
        f"{NAIVE_API}/v1/users/{user_id}/sessions",
        headers=AUTH,
        json={"ttl_ms": ttl_ms},
    )
    r.raise_for_status()
    return r.json()  # { id, expires_at, mcp: { url, headers, expires_at } }
3

Build the agent — and let it transact

Point AutoGen’s McpWorkbench at the session’s scoped SSE endpoint, attach it to an AssistantAgent, and stream the run. AutoGen discovers Naive’s tools and runs the multi-step loop for you (call tool → feed result back → continue):
import asyncio
from autogen_agentchat.agents import AssistantAgent
from autogen_agentchat.ui import Console
from autogen_ext.models.openai import OpenAIChatCompletionClient
from autogen_ext.tools.mcp import McpWorkbench, SseServerParams

async def main():
    session = mint_session(ALICE_USER_ID)

    naive_mcp = SseServerParams(
        url=session["mcp"]["url"],          # scoped, per-user endpoint
        headers=session["mcp"]["headers"],  # scoped bearer — never in the URL
        sse_read_timeout=300,
    )

    model_client = OpenAIChatCompletionClient(model="gpt-4o")

    # The workbench must stay open for the duration of the run.
    async with McpWorkbench(server_params=naive_mcp) as workbench:
        agent = AssistantAgent(
            name="ops_agent",
            model_client=model_client,
            workbench=workbench,            # Naive's per-user toolset
            reflect_on_tool_use=True,
            system_message=(
                "You are Alice's operations agent. Use Naive tools to act on her real account."
            ),
        )

        await Console(agent.run_stream(task=(
            "Connect my GitHub, then issue a $50 virtual card called "
            "'Ads budget' for our marketing spend."
        )))

    await model_client.close()

asyncio.run(main())
The model discovers GitHub, returns a connect link for Alice to authorize, and attempts to issue the card — a real card on Alice’s account, capped by her kit. The whole agent loop is AutoGen’s; the real-world actions are Naive’s.
That’s the moat in ~40 lines: the same AutoGen agent that would otherwise just describe spending money now issues a policy-bounded card on a specific user’s account.

Extension: human-in-the-loop spend

Because the kit set cards.requiresApproval: true, the agent cannot silently spend. You get two complementary layers — pair them for defense in depth:
  • In the conversation — drop a UserProxyAgent into the team so a human is asked to confirm before the team continues.
  • On the server — even if a call gets through, Naive freezes it and returns a pending approval (HTTP 202) instead of a live card. This holds no matter what runtime calls it.
A UserProxyAgent (or a TextMentionTermination("APPROVE") gate that pauses the team) is a UX / early-interrupt convenience — it shapes the conversation, not the account. The real enforcement is Naive’s server-side approval gate below, which applies regardless of prompt or agent configuration.
When a gated call reaches Naive, the tool result comes back as a pending approval rather than a live card:
{
  "status": "pending_approval",
  "approval_id": "65589c8b-e033-4a65-b16c-379211c94429",
  "action": "cards.create",
  "primitive": "cards",
  "title": "Issue virtual card \"Ads budget\"",
  "message": "This action requires human approval before it executes."
}
The immediate 202 response uses action; approval records from the approvals API use action_type. Your app then resolves it out of band — and on approval, Naive replays the frozen action server-side:
def list_pending(user_id: str) -> list[dict]:
    r = httpx.get(
        f"{NAIVE_API}/v1/users/{user_id}/approvals",
        headers=AUTH,
        params={"status": "pending"},
    )
    r.raise_for_status()
    return r.json()["approvals"]

def approve(user_id: str, approval_id: str) -> dict:
    r = httpx.post(
        f"{NAIVE_API}/v1/users/{user_id}/approvals/{approval_id}/approve",
        headers=AUTH,
    )
    r.raise_for_status()
    return r.json()

# Find what the agent queued for Alice, then approve (or deny) it.
for a in list_pending(ALICE_USER_ID):
    # ...show a["title"] / a["action_type"] to a human in your UI...
    approve(ALICE_USER_ID, a["id"])  # API replays cards.create → real card
See Approvals for the full lifecycle (pending → executed / failed / denied) and the deny endpoint.
Approvals are only enforced for agent (API-key / MCP) calls on real tenant users. A human acting in your dashboard, and agent calls on the operator’s own default user, bypass the gate — so end-user agents stay governed while your own automation isn’t slowed down.

A multi-agent team that transacts

AutoGen’s signature is teams: several agents that plan, critique, and hand off until the job is done. Keep that — and let only the operator agent hold Naive’s per-user toolset. The planner reasons in plain text; the operator is the one with a real account, still bounded by the same Account Kit and approval gate:
import asyncio
from autogen_agentchat.agents import AssistantAgent
from autogen_agentchat.teams import RoundRobinGroupChat
from autogen_agentchat.conditions import TextMentionTermination
from autogen_agentchat.ui import Console
from autogen_ext.models.openai import OpenAIChatCompletionClient
from autogen_ext.tools.mcp import McpWorkbench, SseServerParams

async def run_team(user_id: str, task: str):
    session = mint_session(user_id)  # fresh, per-user session
    model_client = OpenAIChatCompletionClient(model="gpt-4o")

    naive_mcp = SseServerParams(
        url=session["mcp"]["url"],
        headers=session["mcp"]["headers"],
        sse_read_timeout=300,
    )

    async with McpWorkbench(server_params=naive_mcp) as workbench:
        planner = AssistantAgent(
            name="planner",
            model_client=model_client,
            system_message=(
                "Break the request into concrete steps for the operator. "
                "When the work is done, reply with the single word DONE."
            ),
        )
        operator = AssistantAgent(
            name="operator",
            model_client=model_client,
            workbench=workbench,            # only the operator can transact
            reflect_on_tool_use=True,
            system_message="Use Naive tools to act on this user's real account.",
        )

        team = RoundRobinGroupChat(
            [planner, operator],
            termination_condition=TextMentionTermination("DONE"),
        )
        await Console(team.run_stream(task=task))

    await model_client.close()

asyncio.run(run_team(
    "<user_id>",
    "Connect GitHub, then issue a $50 'Ads budget' card for marketing.",
))
Each Naive session is scoped to one user, so to serve every tenant from the same team definition, mint a fresh session per request and build the McpWorkbench from it. The agents and instructions stay identical — only which user’s session backs the operator’s tools changes, and every call is Account-Kit-gated server-side. Revoke a session early with DELETE /v1/users/{user_id}/sessions/{id}.

What stays enforced

No matter which path you choose, the policy is enforced where it matters — on Naive’s servers, not in your prompt or your agents:
  • Identity — every action runs as a specific tenant user, fully isolated from your other users.
  • Capability bounds — the Account Kit decides which primitives and which apps the agent can touch (allowlist / blocklist / per-tool).
  • Scoped spend — virtual cards are capped per card and per user; the model can’t raise its own limit.
  • Human-in-the-loop — sensitive actions (cards, domains, KYC, formation, connecting an app) freeze as approvals until a human says yes.

Next steps

  • SDK overview — the full Naive client surface
  • Sessions — per-user MCP sessions for any MCP-aware runtime
  • Account Kits — author spend/capability policy
  • Approvals — the human-in-the-loop lifecycle
  • MCP server — how Naive’s hosted MCP server works