Question 1

Which frameworks does MACAW support?

Accepted Answer

MACAW provides drop-in secure adapters for popular AI frameworks:

| Framework | Adapter | Status |
|-----------|---------|--------|
| OpenAI | SecureOpenAI | Production-ready |
| Anthropic/Claude | SecureAnthropic | Production-ready |
| LangChain | Full suite (LLMs, memory, agents, tools) | Production-ready |
| MCP (Model Context Protocol) | SecureMCP | Production-ready |
| External MCP (3rd-party servers) | SecureMCPProxy | Production-ready |
| LiteLLM (100+ providers) | SecureLiteLLM | Produc

Question 2

What is a MACAW adapter?

Accepted Answer

A MACAW adapter is a thin wrapper that extends the MACAWClient SDK to provide drop-in replacements for popular AI libraries. The architecture:

┌─────────────────────────────────────────────────────────┐
│                    Your Application                      │
│   from macaw_adapters.openai import SecureOpenAI        │
└─────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────

Question 3

What is SecureOpenAI?

Accepted Answer

SecureOpenAI is a drop-in replacement for the OpenAI Python client. Same API, same methods - but with MACAW protection.

python
 Before
from openai import OpenAI
client = OpenAI()

After (one import change)
from macaw_adapters.openai import SecureOpenAI
client = SecureOpenAI(app_name="customer-support-bot")

Same API works exactly the same
response = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": "Hello"}]
)

Question 4

What is the difference between `macaw_adapters.openai` and `macaw_adapters.openai_ext_tools`?

Accepted Answer

Both provide the same SecureOpenAI API. The difference is trace visibility for registered tools:

| Version | Tool Trace Flow | Architecture |
|---------|-----------------|--------------|
| openai | alice → app ↔ app (loopback) | Single MACAWClient |
| openai_ext_tools | alice → app → app-tools/fn | Two MACAWClients |

Standard (macaw_adapters.openai): A single client owns LLM ops and your registered tools. When the LLM calls a tool, traces show the app calling itself.

Explicit Tools (macaw_ada

Question 5

What is SecureAnthropic?

Accepted Answer

SecureAnthropic is a drop-in replacement for the Anthropic Python client:

python
 Before
from anthropic import Anthropic
client = Anthropic()

After
from macaw_adapters.anthropic import SecureAnthropic
client = SecureAnthropic(app_name="research-assistant")

Same API
response = client.messages.create(
    model="claude-sonnet-4-20250514",
    max_tokens=100,
    messages=[{"role": "user", "content": "Hello"}]
)

Question 6

What is the difference between `macaw_adapters.anthropic` and `macaw_adapters.anthropic_ext_tools`?

Accepted Answer

Both provide the same SecureAnthropic API. The difference is trace visibility for registered tools:

| Version | Tool Trace Flow | Architecture |
|---------|-----------------|--------------|
| anthropic | alice → app ↔ app (loopback) | Single MACAWClient |
| anthropic_ext_tools | alice → app → app-tools/fn | Two MACAWClients |

Standard (macaw_adapters.anthropic): A single client owns LLM ops and your registered tools. When Claude calls a tool, traces show the app calling itself.

Explicit Tools

Question 7

Does MACAW work with LangChain?

Accepted Answer

Yes - comprehensive support. MACAW provides drop-in replacements for LangChain's core components:

| Category | MACAW Components |
|----------|-----------------|
| LLM Classes | ChatOpenAI, ChatAnthropic (or explicit SecureChatOpenAI, SecureChatAnthropic) |
| Memory | ConversationBufferMemory, ConversationBufferWindowMemory, ConversationSummaryMemory |
| Agents | create_react_agent, create_openai_functions_agent, AgentExecutor |
| Tools | SecureToolWrapper, wrap_tools, @secure_tool decorator |
|

Question 8

What is SecureMCP?

Accepted Answer

SecureMCP is a FastMCP-compatible API for building MCP servers you write with MACAW policy enforcement. Every tool invocation is authenticated, authorized, and logged.

python
from macaw_adapters.mcp import SecureMCP, Context

mcp = SecureMCP("calculator")

@mcp.tool(description="Add two numbers")
def add(a: float, b: float) -> float:
    return a + b

if __name__ == "__main__":
    mcp.run()

Question 9

What is External MCP (SecureMCPProxy)?

Accepted Answer

SecureMCPProxy is an inline gateway for external MCP servers you don't control (Snowflake, Databricks, Salesforce, etc.). It wraps 3rd-party MCP servers with MACAW security without modifying them.

python
from macaw_adapters.mcp import SecureMCPProxy

HTTP transport (remote MCP servers)
proxy = SecureMCPProxy(
    app_name="snowflake-mcp",
    upstream_url="http://localhost:9000/mcp"
)

stdio transport (local MCP servers via subprocess)
proxy = SecureMCPProxy(
    app_name="salesforce-dx",

Question 10

When should I use SecureMCP vs External MCP (SecureMCPProxy)?

Accepted Answer

| Use Case | Adapter |
|----------|---------|
| Building your own MCP server | SecureMCP |
| Connecting to Snowflake MCP | SecureMCPProxy |
| Connecting to Databricks MCP | SecureMCPProxy |
| Connecting to Salesforce MCP | SecureMCPProxy |
| Wrapping any 3rd-party MCP server | SecureMCPProxy |

SecureMCP: FastMCP-compatible decorator API. Use @mcp.tool(), @mcp.resource(), @mcp.prompt() decorators to build secure MCP servers.

SecureMCPProxy: Inline gateway pattern. Wraps external MCP servers wit

Question 11

How do I handle multiple users with External MCP?

Accepted Answer

Use bind_to_user() to create per-user proxies with proper identity propagation:

python
from macaw_adapters.mcp import SecureMCPProxy
from macaw_client import MACAWClient, RemoteIdentityProvider

Service creates shared proxy
proxy = SecureMCPProxy(
    app_name="data-platform",
    upstream_url="http://localhost:9000/mcp"
)

Authenticate users via your IdP (Keycloak, Okta, etc.)
alice_jwt, _ = RemoteIdentityProvider().login("alice", "Alice123!")
alice = MACAWClient(user_name="alice", iam_token

Question 12

What is SecureLiteLLM?

Accepted Answer

SecureLiteLLM wraps [LiteLLM](https://docs.litellm.ai) to access 100+ LLM providers with MACAW security. True drop-in replacement - just change your import.

python
 Before
import litellm
response = litellm.completion(model="groq/llama3-70b-8192", messages=[...])

After
from macaw_adapters import litellm
response = litellm.completion(model="groq/llama3-70b-8192", messages=[...])

Supported providers include: Groq, Together AI, Mistral, OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Verte

Question 13

Can I use SecureLiteLLM with local models?

Accepted Answer

Yes. Use the api_base parameter to connect to local models:

python
from macaw_adapters import litellm

vLLM
response = litellm.completion(
    model="openai/llama3",
    messages=[...],
    api_base="http://localhost:8000/v1"
)

Ollama
response = litellm.completion(
    model="ollama/llama3",
    messages=[...],
    api_base="http://localhost:11434"
)

Local models get the same MACAW security: policy enforcement, cryptographic signing, and audit logging.

Question 14

What is the `app_name` parameter?

Accepted Answer

app_name identifies your application in MACAW. It's used for: - Registration: Your app registers as app: - Tool namespacing: Tools become tool:/generate, tool:/complete, etc. - Policy targeting: Policies can allow/deny specific apps (e.g., tool:customer-support-bot/) - Audit logs: All operations are tagged with your app name Choose something descriptive and consistent - it appears throughout the Console.

Question 15

How do I bind user identity to adapter calls?

Accepted Answer

Pass the user's JWT token to carry their identity:

python
client = SecureOpenAI(
    app_name="my-app",
    jwt_token=user_jwt,   From your IdP
    user_name="alice"
)
 All calls now carry Alice's identity
 Policies apply based on her claims

For multi-user SaaS apps, use bind_to_user() to efficiently share one service across many users. See [Identity Integration](/docs/identity) for details.

Question 16

Can I build my own adapter?

Accepted Answer

Yes. All adapters extend MACAWClient from the SDK. To build your own: 1. Import MACAWClient from macaw_client 2. Create tools that wrap your target API 3. Register tools with MACAW-compliant names (tool:/) 4. Route calls through invoke_tool() for policy enforcement python from macaw_client import MACAWClient class SecureMyAPI: def __init__(self, app_name: str): self.client = MACAWClient( app_name=app_name, tools={ f"tool:{app

Question 17

Can I use async/await with MACAW adapters?

Accepted Answer

Yes. All adapters support both sync and async:

python
 Sync
response = client.chat.completions.create(...)

Async
response = await client.chat.completions.acreate(...)

The async versions work exactly like the underlying OpenAI/Anthropic async APIs.

Question 18

Do adapters support streaming?

Accepted Answer

Yes. Streaming works exactly like the underlying APIs:

python
stream = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": "Hello"}],
    stream=True
)

for chunk in stream:
    print(chunk.choices[0].delta.content, end="")

Policy enforcement happens at the start of the stream. Audit logging captures the complete interaction.

Question 19

Do I need to change my existing code?

Accepted Answer

Minimal changes. For standard-compliant OpenAI, Anthropic, LangChain, LiteLLM, or MCP:

1. Change the import
2. Add app_name parameter

That's it. Your existing API calls, parameters, and logic stay exactly the same.

Adapters & Frameworks