Seal the Tools: A Weekend Allowlist for Agent Side Projects

Описание и применение

Внедрите локальный шлюз, ограничивающий вызовы инструментов до безопасных файловых операций, с лимитом размера и аварийным переключателем, который останавливает агент после пяти неверных вызовов.

Задача

Side‑project agents can unintentionally execute dangerous commands (e.g., rm, curl) because tool calls are not constrained.

Результат

A single‑process gate that permits only safe file operations within a workspace, caps write size, and stops the agent after five consecutive invalid calls.

Рабочий процесс

• Define a JSON allowlist with workspace_root, max_write_bytes, breaker_threshold, and tool rules.
• Implement a ToolGate that loads the policy, resolves paths, checks prefixes, and enforces key/size constraints.
• Track consecutive denials in breaker.json; open the breaker after threshold and refuse all further calls.
• Create a CLI that reads a tool call JSON, passes it to ToolGate, and prints ALLOW or DENY with a reason.
• Test the gate using a fixture file to simulate model output without network calls.

Доказательства

The demo below is a local allowlist plus a fail‑closed circuit breaker.

Источник

Three tools: write_file, read_file, list_dir

Источник

A fail‑closed breaker after N consecutive denials

Источник