Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

tool-arg-guard — gate kind + catalog pack for deterministic tool-argument validation

Open
  • Is something wrong?
#58 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
python
Domain
devtools, security

Research direction

The issue names pre-tool-use hooks and the mcp-gateway tool_use surface, but no files or tests; first trace where each surface exposes structured tool arguments and how the existing shell guard is cataloged. Done means a declarative argument-constraint gate and seed pack cover the proposed cases, with coverage reported per surface and free-text shell remaining advisory or handled by existing guards.

Written by the indexing model from the issue text.

Description

Problem

Tool misuse via LLM-extracted arguments (OWASP ASI02): an agent told to "delete the old archive" extracts a path that resolves to root, concatenates unsanitized strings into shell/SQL, or walks a path traversal out of the workspace. Today the catalog's enforced answer covers the shell slice only (block-destructive-commands); typed tool schemas validate shape, not safety (a perfectly typed path can still be /).

Proposal

A new gate kind for declarative, deterministic tool-argument constraints, evaluated wherever tool calls are interceptable:

  • constraint vocabulary: path containment (must resolve inside repo/declared roots), regex allow/deny per argument, enum/type checks, value ceilings, cross-arg predicates (e.g. recursive=true requires containment depth ≥ 2)
  • surfaces: pre-tool-use hooks where the client exposes structured tool args; mcp-gateway tool_use for MCP-routed calls
  • catalog seed pack: filesystem-delete guard, path-traversal block, shell-concat deny, SQL-string deny

Honest caveats (from the wedge-line PowerShell lesson)

  • Argument vocabulary is per-client — a guard that matches one client's tool schema and reports "enforced" while missing another's native forms is the overclaim failure Chock exists to refuse. Coverage rows must be per-surface.
  • Only surfaces exposing structured args can rise above advisory; free-text shell stays with the existing shell guards.

Mechanizes agent_discipline/ASI02 beyond shell, and gives the mcp-gateway a second gateway-native policy family beside egress.

Dominant language
Python
Stars
8
Forks
1
Avg merge
2h 48m
Merged PRs (30d)
114

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from open-coder-ai/chock

All issues in open-coder-ai/chock

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.