Tool security model #23

New issue

Closed

opened 2026-05-07 01:29:53 -04:00 by jasoncouture · 1 comment

jasoncouture commented

2026-05-07 01:29:53 -04:00

(Migrated from github.com)

Authorization model for which agents / tools / scopes can run what. Today every loaded tool is callable by every agent that sees its source — fine for a single-operator dev box, not fine for multi-tenant or internet-exposed deployments.

Depends on / pairs with unsafe-tools gating (#24).

Tracked in TASKS.md.

jasoncouture commented

2026-05-24 19:01:00 -04:00

(Migrated from github.com)

Tool security model landed in #109 — IToolFilter gates tool discovery (ModelContextProtocolToolDiscovery) with per-agent AgentBehaviorOptions (Sources, Tools, Skills) and policies Default / Allow / Deny / Disable. Sources and tools are filtered before they reach the language model's tool list — the model cannot select what it does not see.

Tool security model landed in #109 — `IToolFilter` gates tool discovery (`ModelContextProtocolToolDiscovery`) with per-agent `AgentBehaviorOptions` (`Sources`, `Tools`, `Skills`) and policies `Default` / `Allow` / `Deny` / `Disable`. Sources and tools are filtered before they reach the language model's tool list — the model cannot select what it does not see.