Login

u/GameChacking

r/LangChain r/crewai
Updated my tool-call gate after the feedback — what's still missing?
▲ 2 r/LangChain

Updated my tool-call gate after the feedback — what's still missing?

Follow-up to my previous post: https://www.reddit.com/r/LangChain/comments/1wo5bxo/i_built_a_local_runtime_check_for_ai_agent_tool/

>That thread got a lot of sharp feedback - schema pinning on MCP, server-side intent, real hostname allowlists, SSRF/IMDS, and REQUIRE_APPROVAL as a real gate instead of a log line. I took most of it and shipped v0.2.4.

Repo: https://github.com/aegotrax-dev/aegotrax (tag v0.2.4)
Site: https://aegotrax.com

**What's new in 0.2.4**
- Server-side session intent only (client can't spoof user_intent on verify)
- Hostname allowlists (no substring bypass) + SSRF/IMDS in engine and gateway
- MCP schema pinning + drift detection
- REQUIRE_APPROVAL → approval_id + single-use token → POST /approval/decide → one resume for the same tool+args
- Session TTL, per-session rate limit, audit redaction 

**What it still is not**
- Not a production / enterprise security product
- Not full intent understanding (heuristics + thresholds)
- Not volume caps on sensitive reads yet (slow in-scope exfil without outbound is still a gap) 

**Try**
```bash
git clone https://github.com/aegotrax-dev/aegotrax.git
cd aegotrax
pip install .
agentguard-engine
# curl http://127.0.0.1:8000/health  → version 0.2.4
python examples/approval_flow_demo.py

Curious how others handle the split: "this identity can call this API" vs "this call is still what the user asked for."

u/GameChacking — 8 days ago
▲ 1 r/crewai

I built a local runtime check for AI agent tool calls - looking for people to break it

In practice, damage happens when an agent calls a tool: HTTP, email, DB, files, etc. A hidden instruction in a doc can push the agent to do something the user never asked for — and from the system’s point of view it can still look like a normal tool call.

I built a small open pilot for that moment:

\*\*What it does\*\*
- Intercepts tool calls before they run
- Checks intent + simple data provenance + policy
- Returns ALLOW / BLOCK with a reason
- Writes an audit log

\*\*Stack\*\*
- Risk engine (FastAPI) on localhost
- Python SDK (\`verify\_tool\_call\` / decorator)
- Optional MCP gateway (stdio)
- Docker or pip

\*\*What it is not\*\*
- Not a prompt filter
- Not a production / enterprise security product
- Not a transparent proxy for every existing company agent
- Policy is heuristic — tune it; it will not catch everything

\*\*Try (local sandbox only)\*\*
\`\`\`bash
git clone https://github.com/aegotrax-dev/aegotrax.git
cd aegotrax
docker compose up --build
# or: pip install ".\[demo\]" && agentguard-engine
curl http://127.0.0.1:8000/health
python examples/sdk\_pilot\_example.py

Site: [https://aegotrax.com\](https://aegotrax.com/)

If you run it, I’d genuinely like feedback:

  1. Docker or pip - did install work?
  2. Did you get a clear BLOCK in the example?
  3. What was confusing or wrong?
reddit.com
u/GameChacking — 21 days ago