Java SDK Integration

import org.opena2a.aim.annotations.SecureAction;
import org.opena2a.aim.client.RiskLevel;

public class UserService {

    // Low-risk: read operations
    @SecureAction(capability = "db:read", resource = "users_table")
    public User getUserById(String id) {
        return userRepository.findById(id);
    }

    // High-risk: payment processing (RiskLevel is an enum)
    @SecureAction(
        capability = "payment:process",
        resource = "stripe",
        riskLevel = RiskLevel.HIGH
    )
    public PaymentResult processPayment(PaymentRequest request) {
        return paymentService.process(request);
    }

    // Critical-risk with JIT access (requires admin approval)
    @SecureAction(
        capability = "db:delete",
        resource = "users_table",
        riskLevel = RiskLevel.CRITICAL,
        jitAccess = true,
        jitTimeout = 300  // 5 minutes to approve
    )
    public void deleteUser(String userId) {
        // Execution pauses until admin approval
        userRepository.deleteById(userId);
    }
}

import org.opena2a.aim.annotations.SecureActionAspect;
import org.opena2a.aim.client.AIMClient;

@Configuration
@EnableAspectJAutoProxy
public class SecurityConfig {

    @Bean
    public AIMClient aimClient() {
        return AIMClient.builder("my-spring-agent").build();
    }

    @PostConstruct
    public void configureAspect() {
        SecureActionAspect.setClient(aimClient());
    }
}

import org.opena2a.aim.security.SecurityLogger;
import org.opena2a.aim.security.EventTypes;

SecurityLogger logger = SecurityLogger.getInstance();
String sessionId = logger.startSession();

// Set agent context for all subsequent logs
logger.setAgentContext(
    agent.getAgentId().toString(),
    agent.getAgentName(),
    "user-123",
    "org-456"
);

// Log authentication events (written as JSON Lines)
logger.logAuthentication(
    EventTypes.Authn.TOKEN_REFRESH,
    true,
    "Token refreshed successfully",
    Map.of("tokenId", "abc123")
);

// Log authorization events
logger.logAuthorizationEvent(
    EventTypes.Authz.CAPABILITY_GRANTED,
    "db:read",
    "users_table",
    true,
    Map.of("riskLevel", "LOW")
);

import org.opena2a.aim.security.RiskDetector;
import org.opena2a.aim.security.RiskLevel;

RiskDetector detector = RiskDetector.getInstance();

// Detect risk for a capability
RiskLevel level = detector.detectRisk("admin:delete");
// Returns: CRITICAL

// Risk patterns:
// api:*, file:read          → LOW
// db:read, db:write         → MEDIUM
// db:delete, payment:*      → HIGH
// admin:*, system:*         → CRITICAL

// Aggregate risk for multiple capabilities
List<String> capabilities = Arrays.asList("api:call", "db:read", "payment:process");
RiskLevel aggregate = detector.detectAggregateRisk(capabilities);
// Returns: HIGH (highest of all)

// Check if approval required
if (level.requiresApproval()) {
    // Trigger JIT access workflow
}

import org.opena2a.aim.mcp.AttestationCache;
import org.opena2a.aim.integrations.mcp.discovery.MCPDiscoveryResult;
import org.opena2a.aim.integrations.mcp.discovery.MCPTool;

AttestationCache cache = AttestationCache.getInstance();

// Store initial attestation
List<MCPTool> tools = Arrays.asList(
    new MCPTool("read_file", "Read file contents", null),
    new MCPTool("write_file", "Write to file", null)
);

MCPDiscoveryResult discovery = MCPDiscoveryResult.builder()
    .serverName("filesystem-mcp")
    .tools(tools)
    .connectionLatencyMs(50)
    .build();

cache.store("filesystem-mcp", discovery, "attestation-123");

// Later, check for drift (new tool added - possible supply chain attack!)
List<MCPTool> currentTools = Arrays.asList(
    new MCPTool("read_file", "Read file contents", null),
    new MCPTool("write_file", "Write to file", null),
    new MCPTool("delete_file", "DELETE FILES!", null)  // NEW!
);

MCPDiscoveryResult currentDiscovery = MCPDiscoveryResult.builder()
    .serverName("filesystem-mcp")
    .tools(currentTools)
    .build();

AttestationCache.DriftReport drift = cache.detectDrift("filesystem-mcp", currentDiscovery);

if (drift.hasDrift()) {
    System.out.println("ALERT: MCP capability drift detected!");
}

// Register MCP Server
Map<String, Object> result = agent.registerMcp(
    "filesystem-mcp",     // server ID
    "sdk_registration",   // detection method
    0.85                  // confidence score
);

// List MCP Servers
List<Map<String, Object>> servers = agent.listMcpServers(20);
for (Map<String, Object> server : servers) {
    System.out.println(server.get("name") + ": " + server.get("status"));
}

// Attest MCP Server (cryptographic verification)
Map<String, Object> attestation = agent.attestMcp(
    serverId,
    "http://localhost:3001",
    "filesystem-mcp",
    Arrays.asList("read_file", "write_file"),
    45.0  // confidence threshold
);

// Record tool usage
agent.useMcpTool(serverId, "read_file", "http://localhost:3001", "filesystem-mcp");

import org.opena2a.aim.integration.langchain4j.AIMToolExecutor;
import org.opena2a.aim.integration.langchain4j.AIMAgentCallback;

// Create tool executor with security wrapper
AIMToolExecutor executor = new AIMToolExecutor(agent);

// Register tools with required capabilities
executor.register("search_web", "Search the web",
    input -> webSearch(input), "api:call");

executor.register("read_database", "Query database",
    input -> queryDatabase(input), "db:read");

executor.register("admin_override", "Admin operations",
    input -> adminOp(input), "admin:override");

// Configure risk-based blocking
executor.setBlockHighRisk(true);
executor.setApprovalThreshold(RiskLevel.HIGH);

// Execute with automatic verification
try {
    Object result = executor.execute("search_web", "AI safety");
    // Success - capability verified
} catch (AIMToolExecutor.ToolBlockedException e) {
    System.out.println("Tool blocked: " + e.getRiskLevel());
}

// Get execution metrics
Map<String, Map<String, Object>> metrics = executor.getAllMetrics();

import org.opena2a.aim.exceptions.*;

try {
    agent.performAction("db:delete", "users", () -> deleteAllUsers());
} catch (ActionDeniedException e) {
    System.err.println("Denied: " + e.getCapability() + " on " + e.getResource());
} catch (VerificationException e) {
    System.err.println("Verification failed: " + e.getMessage());
} catch (AuthenticationException e) {
    System.err.println("Auth failed: " + e.getMessage());
} catch (CredentialException e) {
    System.err.println("Credential error: " + e.getMessage());
} catch (AIMException e) {
    System.err.println("AIM error: " + e.getMessage());
}