Secure agent tool calls at ingress
Single prompts were already hard to govern. Agents made it structural.
An agent does not ask one question and wait. It reads files, calls shell commands, writes code, hits APIs, and loops until the task is done. Each step is a tool call. Each tool call is a potential data leak, a policy violation, or an execution you cannot explain to an auditor.
The failure mode is predictable: an agent in Cursor is asked to set up a pipeline. It finds credentials in the repo, passes them into model context, then calls a deployment tool with arguments nobody reviewed. The UI shows a green checkmark. Security finds out later — if at all.
Agents changed the threat model
Three properties of agentic workflows break assumptions built for chat-only AI:
- Volume. A single user request can trigger dozens of tool calls in minutes. Manual review does not scale.
- Opacity. Tool arguments often contain secrets, file paths, and customer identifiers that never appear in the chat bubble the user sees.
- Composition. An agent chains read → reason → execute. A secret picked up in step two is exfiltrated in step four through a different tool entirely.
Prompt engineering cannot fix this. Instructions like "never include secrets" degrade as context grows, models change, or agents chain calls across tools. You need enforcement at the boundary where calls are made.
The ungoverned gap
Most teams ship agents before they ship governance. The stack looks like this:
- Agent (L5) → Model API or Sandbox (L1)
- No interception. No policy check. No durable record beyond whatever the client UI stores.
- Blekline sits in the middle, Layer 4 ingress, so every prompt and tool call is evaluated before it reaches a model or a Daytona-class sandbox runtime.
- Agent (L5) → Blekline (L4) → Model / Sandbox (L1–L2)
The agent keeps working. Governance becomes infrastructure.
Ingress, not output filtering
Post-model guardrails validate outputs. That is useful, especially for structure and format. But output filtering cannot undo a shell command that already ran, or un-send an API key that already entered model context.
Ingress governance is pre-execution. It evaluates what is about to happen, not what already happened. For agents, that means governing tool calls at the MCP boundary, before run_shell, write_file, or query_database executes.
What ingress governance does
Blekline provides three capabilities at the ingress boundary:
- Mask prompts.
blekline_mask_promptredacts PII, payment card patterns, secrets, and other sensitive entities before text reaches a model. Masking runs through the control plane; audit events record entity counts and actions, not raw prompt bodies by default. - Evaluate tool calls.
blekline_evaluate_tool_callchecks tool name and arguments against workspace policy. Policy returns allow, mask, or block before the tool runs. - Emit audit events. Each decision produces metadata: action taken, risk tier, tool name, client surface, model provider, and a correlation ID. Enough to investigate, report, and prove control — without storing full argument payloads in default configuration.
Stack placement
Blekline integrates at the MCP layer — the protocol agents already use to reach tools.
- Direct MCP server. Install
@blekline/mcp-serverin Cursor, Claude Desktop, or Continue. The agent calls Blekline tools for mask and enforce; Blekline tools wrap your governance policy. - MCP proxy. Run
@blekline/mcp-proxyin front of existing MCP servers (sandbox runtimes, internal APIs, databases). Traffic passes through Blekline before reaching downstream tools, without rewriting every server. - REST ingress. For custom agents, call
/api/maskand/api/mcp/enforce-tool-calldirectly from your application layer.
Same policy, same evidence model, regardless of which agent client your team uses.
EU AI Act hook
The EU AI Act's human oversight requirements (Article 14) do not mean a human watches every agent call. They mean your system must support intervention, tool calls that can be flagged, blocked, or held for review. Logging requirements (Articles 12 and 17) mean you need records of what your AI systems did and what policy decided. Ingress enforcement is the intervention mechanism. The metadata event stream is the record.
Blekline provides the infrastructure layer for both. Classification of whether your system is high-risk, and conformity documentation, still require legal analysis, see our compliance article for the full mapping.
Rollout
A practical sequence for engineering teams:
- Connect one agent client via MCP, Cursor or Claude Desktop is a common starting point
- Configure workspace tool policy at
/operations/policies, start with block rules for high-risk tools (shell, arbitrary network) - Enable mask on prompt ingress for secrets and PII
- Review the activity stream for a week, tune false positives before tightening
- Add the MCP proxy in front of sandbox or internal tool servers as agents gain more capability
Governance should feel like adding a load balancer, not rewriting your agents.
Related reading
