Unsafe Tool Calls

# Detect and block unsafe tool usage patterns
class UnsafeCallDetector:
    BLOCKED_TOOLS    = {"exec_shell", "eval_code", "modify_agent_config"}
    SENSITIVE_TOOLS  = {"delete_record", "issue_refund", "send_bulk_email"}
    SAFE_FILE_PATHS  = {"/app/data/", "/app/reports/"}
    APPROVED_DOMAINS = {"api.openai.com", "api.stripe.com", "api.sendgrid.com"}

    @classmethod
    def inspect(cls, tool_name: str, args: dict) -> dict:
        """Inspect a tool call before execution. Returns allow/block decision."""

        # Hard block: certain tools are never allowed
        if tool_name in cls.BLOCKED_TOOLS:
            return {"decision": "block",
                    "reason": f"Tool '{tool_name}' is unconditionally blocked"}

        # Check for path traversal in file tools
        if tool_name in ("read_file", "write_file"):
            path = args.get("path", "")
            if ".." in path:
                return {"decision": "block",
                        "reason": f"Path traversal detected: '{path}'"}
            if not any(path.startswith(safe) for safe in cls.SAFE_FILE_PATHS):
                return {"decision": "block",
                        "reason": f"File path '{path}' outside approved directories"}

        # Check for unapproved domains in HTTP tools
        if tool_name == "http_request":
            url = args.get("url", "")
            from urllib.parse import urlparse
            domain = urlparse(url).netloc
            if domain not in cls.APPROVED_DOMAINS:
                return {"decision": "block",
                        "reason": f"Domain '{domain}' not in approved list"}

        # Flag sensitive tools for extra logging
        if tool_name in cls.SENSITIVE_TOOLS:
            return {"decision": "allow_with_audit",
                    "reason": f"Sensitive tool — logging and audit required"}

        return {"decision": "allow", "reason": "Passed all checks"}

tests = [
    ("exec_shell",   {"command": "rm -rf /"}),
    ("read_file",    {"path": "../../etc/passwd"}),
    ("read_file",    {"path": "/app/data/report.csv"}),
    ("http_request", {"url": "https://evil.com/exfiltrate"}),
    ("issue_refund", {"order_id": "O1", "amount": 50}),
]
for tool, args in tests:
    result = UnsafeCallDetector.inspect(tool, args)
    print(f"  {tool:15} → {result['decision']:20} | {result['reason'][:50]}")