Loading ToolBench
Fast deterministic pre-execution filter for AI agent tool calls. Pattern-matches known scope-creep (S3) and prompt-injection (S2b) vectors (destructive shell/SQL, credential reads, SSRF, out-of-mandate writes) and blocks them in ~25 microseconds with no LLM in the hot path. A first-line pre-filter, not a sandbox or a formal guarantee.
Aletheia provides well-structured tool definitions with clear security-focused descriptions and complete input schemas. All 6 tools have descriptions (194 - 280 chars, within baseline 34 - 392 range) and typed parameters with descriptions. However, output schemas are not documented, LLMs cannot predict return structures. Error handling lacks recovery guidance (e.g., 'if mandate validation fails, call aletheia_get_mandate to inspect current state'). Tool naming is clear and verb-forward (set_, get_, intercept, safe_*), but composition could be tighter: aletheia_intercept duplicates logic with aletheia_safe_bash/safe_sql rather than being called internally. No pagination, batch operations, or natural-identifier support (e.g., tool_name as string vs structured tool reference). Security is strong (no secrets in params, permission gates via mandate), but parameter descriptions lack format/range constraints (e.g., 'timeoutMs' has no min/max bounds).
Retrieve the current operational safety mandate, permissions, and active boundary constraints.
Retrieve runtime safety telemetry: total tool calls evaluated, block rate %, latency percentiles (p50, p95, p99 < 1ms), and violation counts broken down by signature.
Universal sub-millisecond safety gatekeeper. Evaluates any proposed tool invocation against Signature S3 (Scope Creep) and S2b (Prompt Injection) to block destructive, out-of-boundary, or compromised actions before execution.
Execute a shell/bash command with inline sub-millisecond Signature S3 scope creep protection. Blocks destructive deletes (rm -rf), disk formatting, fork bombs, credential harvesting, privilege escalation, and unauthorized network egress.
Audit or execute a database query with Signature S3 safety filters. Detects destructive DDL (DROP, TRUNCATE), unbounded DML (DELETE/UPDATE without WHERE), and privilege tampering.
Output schemas not documented. LLMs cannot predict return structure (fields, types, pagination) for any tool. Breaks downstream tool chaining and forces agents to guess field names.
Error handling lacks recovery guidance. Errors do not tell LLM what to do next (retry, ask user, call alternative tool). E.g., 'mandate validation failed' should suggest 'call aletheia_get_mandate to inspect current state'.
Parameter constraints missing. 'timeoutMs' has no min/max bounds (unbounded numeric invites absurd values). 'auditLogLimit' lacks range. 'riskTolerance' enum is present but other params lack format/length constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Establish or update the active operational safety mandate for this agent session. Declares permissible boundaries, allowed tools, filesystem directories, write permissions, and risk tolerance. Loosening restrictions requires operatorSecret.
Composition issue: aletheia_intercept duplicates validation logic with aletheia_safe_bash and aletheia_safe_sql. Should be called internally by safe_* tools, not exposed as a separate tool. Increases LLM reasoning overhead.
No pagination or batch operations. aletheia_get_telemetry returns audit logs but no cursor/offset/limit structure documented. Large audit logs could blow context window.