pantheon-tool-sanitizer 0.1.0

Neutralise prompt-injection / tool-poisoning in untrusted MCP/LLM tool text before it reaches the system prompt.

pantheon-tool-sanitizer

Neutralise prompt-injection / tool-poisoning in untrusted tool text before it reaches an LLM's system prompt. Zero dependencies, ~40 lines.

The problem: when your agent consumes tools from an external source — an MCP server, a plugin registry, a third-party API — that source's tool name and description are attacker-controlled, and they get rendered into the trusted instruction channel (the planner's system prompt). A hostile server can weaponise that.

Extracted from PANTHEON, where it guards the inbound MCP transport — the point where a governed agent consumes an external, possibly-hostile server's tools.

The attack (tool poisoning)

A malicious tool description can:

• fake a tool-call — embed <function_calls>… or a {"action": ...} object so the model believes a tool ran;
• hide or reorder text — Unicode zero-width and bidirectional-override characters render invisibly, so your human review sees one thing and the model sees another (safe‮IGNORE ALL PRIOR RULES);
• smuggle instructions across lines — a multi-line description that reads as new system directives.

The fix

from tool_sanitizer import sanitize_remote_tool_text

safe_name = sanitize_remote_tool_text(remote_tool["name"], max_len=64)
safe_desc = sanitize_remote_tool_text(remote_tool["description"])

if not safe_name:          # a name that sanitises to nothing (pure markup/invisibles) is unsafe → skip the tool
    continue

sanitize_remote_tool_text collapses the whole vector to inert, single-line prose:

1. strips invisible / bidi / control characters,
2. removes tool-protocol markup (so it can't fake a tool call),
3. flattens whitespace so nothing spans lines or injects instructions,
4. caps the length,
5. returns "" when nothing safe remains — a signal to skip that tool entirely.

Run it on every untrusted tool name and description before they touch the prompt. strip_tool_markup is also exported for cleaning model output (so a user never sees raw markup).

Install

pip install pantheon-tool-sanitizer      # or copy the single tool_sanitizer.py file

Scope

This is one specific control — input sanitisation of tool metadata. It is not a full agent-security layer (you still want capability gating, approval on consequential actions, and treating tool output as untrusted data). It closes the tool-poisoning-via-metadata hole cleanly.

License

Apache-2.0. See LICENSE.