Multi-Agent Workflow Lab

An open-source testing and observability framework for multi-agent delegation, tool execution, MCP workflows, permissions, sandboxed actions, prompts, and runtime behavior.

Status: Experimental — v0.1.0 release candidate. Suitable for local development, evaluation, and policy testing; not production-hardened infrastructure.

Why this exists

Most model evaluation stops at input → model → output. Multi-agent systems add behavior that a final answer cannot explain:

• Which agent delegated a task, to whom, and why?
• What context, permissions, tools, MCP servers, and budget did the child receive?
• Did an agent attempt privilege escalation, repeat work, or enter a loop?
• Was the delegation efficient, and was the child result actually integrated?
• Can the run be inspected, compared, or replayed without repeating side effects?

MAWL makes those decisions explicit, policy-controlled, and traceable. Prompts are versioned assets; delegation is a first-class runtime event; deterministic rules evaluate behavior independently from optional model judges.

Key capabilities

Area	What is implemented
Agent runtime	Typed model actions, task limits, cancellation, retries, and deterministic mock execution
Delegation	Parent/child task graph, target and capability checks, depth/fan-out limits, loop detection, and result integration events
Tool execution	Registry-based invocation with schema validation, allowlists, permissions, policy, optional approval, redaction, timeout, and audit
MCP	Official stdio and Streamable HTTP client adapters plus an in-memory mock connector; MCP data remains untrusted
Sandbox	Restricted local-process adapter and optional Docker provider interface with auditable lifecycle events
Identity and permissions	Runtime-issued agent identity, local development auth, deny-by-default permission and contextual policy engines
Prompt system	Semantic versions, SHA-256 hashes, strict variables, trusted/untrusted provenance, and deterministic prompt-injection signals
Input parsing	JSON, YAML, Markdown, text, and structured-task normalization
Observability	Append-only events, SQLite/JSONL storage, structured logs, task traces, Mermaid delegation graphs, metrics, budgets, and monitors
Evaluation	Nine deterministic rules, eight diagnostic dimensions, assertions, YAML specs, run comparison, prompt regression, and optional model judge
Replay	Exact reconstruction, dry run, model rerun, and guarded tool rerun
Security testing	Prompt injection, escalation, malicious MCP/tool output, secret leakage, traversal, sandbox, recursion, and resource-exhaustion cases