Seal the Tools: A Weekend Allowlist for Agent Side Projects

Description and use

Implement a local gate that restricts tool calls to safe file operations, enforces size limits, and halts the agent after five consecutive invalid calls.

Problem

Side‑project agents can unintentionally execute dangerous commands (e.g., rm, curl) because tool calls are not constrained.

Outcome

A single‑process gate that permits only safe file operations within a workspace, caps write size, and stops the agent after five consecutive invalid calls.

Workflow

• Define a JSON allowlist with workspace_root, max_write_bytes, breaker_threshold, and tool rules.
• Implement a ToolGate that loads the policy, resolves paths, checks prefixes, and enforces key/size constraints.
• Track consecutive denials in breaker.json; open the breaker after threshold and refuse all further calls.
• Create a CLI that reads a tool call JSON, passes it to ToolGate, and prints ALLOW or DENY with a reason.
• Test the gate using a fixture file to simulate model output without network calls.

Evidence

The demo below is a local allowlist plus a fail‑closed circuit breaker.

Source

Three tools: write_file, read_file, list_dir

Source

A fail‑closed breaker after N consecutive denials

Source