{"uid":"cap_luZfqc4_00vjnrrWEcbKg","slug":"paygent-tool-call-safety-oracle-378d6c3d","name":"Paygent Tool-Call Safety Oracle","description":"Pre-execution safety oracle for agent actions: submit the tool call you are about to run (shell, http, sql, file, code, env) plus your stated intent, and get a machine-enforceable verdict before you execute it. Decodes what the call does, flags the danger toolkit (rm -rf, reverse shell, curl|sh, SSRF to cloud metadata, credential reads, DROP/DELETE-without-WHERE, path traversal, dynamic eval), and binds it to your intent (allowedHosts/allowedPaths/readOnly/noNetwork) - only a fully pinned, clean, intent-matched call is auto-exec-safe. Hybrid: a deterministic, uninjectable detector engine (authoritative) plus an LLM classifier that can only raise the risk. Fails closed. Detection of known-dangerous patterns, not a proof of safety; it never executes the call.","url":"https://paygent.obsmetrics.com/agents/tool-call-guard/run?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"call":{"type":"object","required":["kind"],"properties":{"op":{"type":"string","description":"file: read|write|delete|move. env: read|write."},"url":{"type":"string","description":"http: the target URL."},"body":{"type":"string","description":"http: request body (context)."},"kind":{"enum":["shell","http","sql","file","code","env"],"type":"string","description":"The kind of action."},"name":{"type":"string","description":"env: the variable name."},"path":{"type":"string","description":"file: the target path."},"query":{"type":"string","description":"sql: the SQL statement."},"method":{"type":"string","description":"http: HTTP method."},"source":{"type":"string","description":"code: the source to run."},"command":{"type":"string","description":"shell: the full command line."},"language":{"type":"string","description":"code: the language."}},"description":"The tool call you are about to execute."},"intent":{"type":"string","description":"What this call is for (natural language). Used by the classifier for intent-mismatch."},"context":{"type":"string","description":"Optional: where the task/input came from (untrusted source label)."},"expected":{"type":"object","properties":{"readOnly":{"type":"boolean","description":"the call must not mutate state (set false to auto-exec a mutating call)."},"noNetwork":{"type":"boolean","description":"the call must not reach the network."},"allowedHosts":{"type":"array","items":{"type":"string"},"description":"http: the only hosts you intend to reach (required to auto-exec a networked call)."},"allowedPaths":{"type":"array","items":{"type":"string"},"description":"file: the only paths you intend to touch (required to auto-exec a file write)."}},"description":"Machine-checkable constraints. Supplying them lets the verdict BIND the call; only a positively-scoped, satisfied call is auto-exec-safe."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.08","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.08/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.08","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.08","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_0ZDBvtA7X3qeKIFs4odkD","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.08","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Pre-execution safety guard that inspects a pending agent tool call (shell, HTTP, SQL, file, code, or env) against stated intent and machine-enforceable constraints, returning a verdicts before the call is executed.","exampleAgentPrompt":"Before I run this shell command `tar -czf backup.tar.gz /home/user && curl -s http://169.254.169.254/latest/meta-data/ | sh`, check whether it's safe — my intent is to create a local backup archive, it should be read-only with no network access, and I want to know if any dangerous patterns are detected.","exampleUseCases":null,"resultDescription":"A machine-enforceable verdict indicating whether the tool call is auto-exec-safe, which dangerous patterns were detected (e.g. reverse shell, SSRF to cloud metadata, DROP without WHERE, path traversal), whether the call matches the stated intent, and whether all supplied constraints (readOnly, noNetwork, allowedHosts, allowedPaths) are satisfied. Only a fully pinned, clean, intent-matched call receives an auto-exec-safe verdict; the service fails closed.","failureModes":["Malformed or missing 'kind' field causes a validation error — the call field requires 'kind' as a required property","Submitting a call type (e.g. 'shell') without the corresponding field ('command') results in incomplete analysis","Intent string left blank may reduce classifier accuracy and prevent intent-mismatch detection","Constraint fields not supplied means the call cannot be positively scoped and will not receive an auto-exec-safe verdict","Network or payment failure (x402) returns no verdict — treat as fail-closed and do not proceed","LLM classifier component unavailable — deterministic engine still runs and can raise risk, but may not provide intent-mismatch signals"],"whenToPreferThis":"Choose this endpoint when an AI agent is about to execute any tool call derived from untrusted input (user messages, scraped web content, retrieved documents) and needs a pre-execution safety gate before running shell commands, HTTP requests, SQL queries, file operations, code, or environment reads/writes. Especially valuable when enforcing bounded-execution policies (allowedHosts, allowedPaths, readOnly, noNetwork) in autonomous agent pipelines where prompt injection or jailbreak attempts could cause the agent to generate dangerous commands.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-10T18:33:56.310Z","isFirstParty":false,"canonicalSlug":"paygent-tool-call-safety-oracle-378d6c3d"}