Taints the agent when tool results carry untrusted content, gates the privileged calls that follow, and refuses credentials passed to network-capable tools in every mode.

by cdxiaodong

Agent security guardrail: intercepts and audits every tool call, requiring human confirmation on sensitive operations.

Hand off focused context without waiting for or interrupting the active Agent: freeze a bounded Session snapshot, summarize it asynchronously with an isolated no-tool LLM, and deliver a provenance-bea

Runtime security gate on the tool pipeline: denies calls naming hosts outside an egress allowlist, redacts credentials from results at the canonical value rather than only the rendered content, and ap

Source-aware prompt injection guard for DSH: tracks untrusted turn context, detects injection signals, scores sensitive sinks, and blocks high-risk tool calls with explainable audit logs.

Auto-approval permission guard: a middle tier between workspace-write and danger-full-access — auto-allows safe operations inside trust directories, always asks a human for destructive ones, with 11 p