AI Agent Tool Call Security: Aegotrax, a Local Runtime Interception Solution

The Real Risk of AI Agents: The Moment a Tool Is Called

As AI Agents become more widespread, an underestimated security threat is coming into focus: the real damage often happens the moment an Agent calls a tool — whether that's making an HTTP request, sending an email, querying a database, or reading and writing files.

A developer shared their open-source project Aegotrax on Reddit, targeting exactly this problem. They pointed out that a hidden instruction embedded in a document could trick an Agent into performing actions the user never requested — and from a system perspective, it still looks like a perfectly ordinary tool call. This is the most dangerous manifestation of a Prompt Injection attack: it bypasses user intent while wearing the disguise of a legitimate operation.

Prompt Injection refers to attackers embedding malicious instructions into external content that an Agent reads — such as web pages, documents, email bodies, or database return values — in order to hijack the Agent's behavior. Unlike traditional SQL injection, which targets a database parser, prompt injection exploits a fundamental characteristic of large language models: they treat text from system prompts, user inputs, and external data equally. This allows attackers to forge what appears to be a legitimate operation request. When an Agent has the ability to call real tools, the impact of this vulnerability escalates from "outputting wrong information" to "executing irreversible actions" — a qualitative leap in danger. There is currently no widely accepted complete solution in academia or engineering; defensive strategies mainly focus on input sanitization, least-privilege access, and runtime interception.

What Aegotrax Does

Unlike common prompt-filtering approaches, Aegotrax places its defensive line at the critical point of tool execution, rather than at the model's input/output layer. Its logic is clear and restrained:

• Intercepts tool calls: Captures them before the tool actually executes
• Multi-dimensional validation: Checks call intent, basic data provenance, and policy rules
• Issues a definitive verdict: Returns ALLOW or BLOCK with a stated rationale
• Writes an audit log: Leaves a traceable record of every decision

The value of this design lies in shifting the security judgment from the fuzzy territory of "was the model deceived" to the actionable question of "should this operation be permitted." Even if an Agent has already been misled by malicious instructions, this final checkpoint at the tool call layer still has a chance to block dangerous behavior.

Data Provenance, in the context of Agent security, refers to the ability to track where a tool call's parameters "came from" — whether from the user's direct input, the system prompt, or some external document the Agent read during execution. The significance of this is: the same call to "send an email to an address" carries very different risk levels depending on whether the recipient address was explicitly specified by the user, versus pulled from a web page the Agent just fetched. Full data provenance tracking is quite challenging in practice, requiring "taint marking" of parameters to be maintained throughout the entire reasoning chain. Aegotrax currently implements a "simple" form of data provenance, and the author openly acknowledges in the project that this capability is incomplete, relying more on policy rules and intent heuristics to compensate.

Tech Stack and Integration

Aegotrax keeps its engineering implementation lightweight and local, running entirely in a localhost environment:

• Risk engine: Built on FastAPI
• Python SDK: Provides both a verify_tool_call method and a decorator for integration
• Optional MCP gateway: Communicates via stdio, compatible with the Model Context Protocol ecosystem
• Flexible deployment: Supports one-command startup via Docker Compose, or installation via pip

For developers, the decorator pattern means existing tool functions can be wrapped with a layer of runtime protection with minimal changes, without needing to refactor the entire Agent architecture.

MCP (Model Context Protocol) is an open protocol championed by Anthropic, designed to provide a standardized interface for interactions between AI models and external tools or data sources. Its core idea is to abstract "tool capabilities" into discoverable, callable service endpoints, allowing different Agent frameworks and model providers to reuse the same tool ecosystem without needing custom adapters for each combination. MCP uses a JSON-RPC-based message format and supports two transport modes — stdio (standard input/output) and HTTP SSE — the former suited for local inter-process communication, and the latter for networked service scenarios. Aegotrax's optional MCP gateway means it can act as an intermediary proxy layer within any MCP-compatible Agent runtime, performing security checks before tool calls reach their actual execution endpoint, without modifying upstream Agent logic.

The Boundaries the Author Drew

To the author's credit, they are quite honest about what Aegotrax is positioned as, explicitly listing what it is not:

• It is not a prompt filter
• It is not a production-grade or enterprise security product
• It is not a solution that transparently proxies all existing enterprise Agents
• Its policies are heuristic, require self-tuning, and cannot cover all attack scenarios

This kind of transparency is especially valuable in the open-source community. Rather than overstating its protective capabilities, the author positions it as an "open pilot" and publicly invites users to try to break it — which is itself a healthy security validation mindset.

How to Try It Locally

The project emphasizes running only in a local sandbox environment. Developers can get a quick hands-on experience with the following:

git clone https://github.com/aegotrax-dev/aegotrax.git
cd aegotrax
docker compose up --build
# or: pip install ".[demo]" && agentguard-engine
curl http://127.0.0.1:8000/health
python examples/sdk_pilot_example.py

The author is particularly hoping for feedback on: whether the Docker or pip installation process goes smoothly, whether the examples produce clear BLOCK results, and which parts are confusing or contain errors.

A Few Thoughts

As protocols like MCP drive rapid expansion of the Agent tool ecosystem, "Agent security" is moving from theoretical discussion into engineering practice. Aegotrax represents a pragmatic direction: rather than trying to ensure the model is never deceived, add an auditable, explainable gatekeeper before every high-risk operation.

Of course, the limitations of heuristic policies are clear — they may block legitimate calls and could be bypassed by carefully crafted attacks. But given the current lack of standardized Agent runtime security solutions, this kind of open-source exploration gives the community a starting point to disassemble, test, and improve upon.