check_tool
Validate tool names for security compliance by blocking payment/transfer tools and flagging exec/shell tools as sensitive within the shellward MCP server.
Instructions
Check if a tool name is allowed. Blocks payment/transfer tools, flags exec/shell tools as sensitive.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool_name | Yes | Tool name to check (e.g. "bash", "stripe_charge", "file_read") |
Implementation Reference
- src/core/engine.ts:227-256 (handler)The 'checkTool' method in the ShellWard class evaluates whether a specific MCP tool is allowed based on security policies (BLOCKED_TOOLS and SENSITIVE_TOOLS).
checkTool(toolName: string): CheckResult { const toolLower = toolName.toLowerCase() const enforce = this.config.mode === 'enforce' if (BLOCKED_TOOLS.has(toolLower)) { const reason = this.locale === 'zh' ? `安全策略禁止自动执行: ${toolName}` : `Blocked by security policy: ${toolName}` this.log.write({ level: 'CRITICAL', layer: 'L3', action: enforce ? 'block' : 'detect', detail: reason, tool: toolName, }) return { allowed: false, level: 'CRITICAL', reason } } if (SENSITIVE_TOOLS.has(toolLower)) { this.log.write({ level: 'MEDIUM', layer: 'L3', action: 'detect', detail: `Sensitive tool used: ${toolName}`, tool: toolName, }) } return { allowed: true } }