Seal the Tools: A Weekend Allowlist for Agent Side Projects

说明与用途

实现一个本地网关，将工具调用限制为安全的文件操作，强制执行大小限制，并在连续五次无效调用后停止代理。

问题

Side‑project agents can unintentionally execute dangerous commands (e.g., rm, curl) because tool calls are not constrained.

结果

A single‑process gate that permits only safe file operations within a workspace, caps write size, and stops the agent after five consecutive invalid calls.

工作流

• Define a JSON allowlist with workspace_root, max_write_bytes, breaker_threshold, and tool rules.
• Implement a ToolGate that loads the policy, resolves paths, checks prefixes, and enforces key/size constraints.
• Track consecutive denials in breaker.json; open the breaker after threshold and refuse all further calls.
• Create a CLI that reads a tool call JSON, passes it to ToolGate, and prints ALLOW or DENY with a reason.
• Test the gate using a fixture file to simulate model output without network calls.

证据

The demo below is a local allowlist plus a fail‑closed circuit breaker.

来源

Three tools: write_file, read_file, list_dir

来源

A fail‑closed breaker after N consecutive denials

来源