Glossary
Tool proxy
The component that forwards an agent’s or sandboxed program’s tool calls to the real tools, and the natural place to check each call.
Checks run on our GPUs in Switzerland. Request payloads are not stored.Security
What Tool proxy means
A tool proxy is the layer that receives tool calls from an agent, or from code running in a sandbox, and forwards them to the real services. In code mode, the sandbox usually has no direct network access; the only way the generated code can affect the outside world is through the bindings the proxy provides.
That makes the proxy a choke point in the useful sense: every call passes through one place, with its tool name and concrete arguments already resolved. A pre-execution guard called from the proxy can check each call as it happens, including calls produced inside loops or built from data the program read earlier.
A proxy can also enforce deterministic rules before the guard runs, for example refusing tools not on an allowlist, and should decide what to do if the guard is unreachable (see fail closed).
Related terms
How Tool proxy connects to the rest of the vocabulary.