Tools and Side Effects

Runtime integrations include every configured tool by default. ZeroLeaks receives serializable definitions, while executable functions and provider credentials remain in your SDK process.

Complete definitionsCopy Anchor Link

Tool metadata supports:

interface AgentTool {
  name: string;
  description?: string;
  inputSchema?: unknown;
  outputSchema?: unknown;
  strict?: boolean;
  type?: string;
  providerOptions?: unknown;
  definition?: unknown;
}

The AI SDK adapter converts flexible schemas to JSON Schema automatically. OpenAI adapters preserve the original native tool object in definition and expose function parameters through inputSchema.

Execution tracesCopy Anchor Link

Reports can include:

• tool name and call ID;
• parsed arguments;
• returned value;
• thrown or returned errors;
• whether the provider executed the tool;
• the attack prompt and isolated scan session that produced the call.

The evaluator uses these traces to distinguish a response that mentions a dangerous command from an executed tool call.

Production behavior versus production dataCopy Anchor Link

Use the same agent configuration and tool-control logic as production, but inject scan-safe dependencies whenever a tool can cause irreversible effects.

Recommended patterns:

• point database tools at an ephemeral database;
• use test tenants and credentials;
• route email, messaging, payments, and webhooks to sinks;
• preserve authorization and approval code paths;
• record intended side effects even when the final external action is intercepted;
• clean up state between scan runs.

ZeroLeaks does not silently disable tools because doing so would hide tool-hijacking vulnerabilities. The application controls whether the tool executor uses live or sandboxed dependencies.

Payload containmentCopy Anchor Link

Before any probe reaches your agent, ZeroLeaks rewrites real external destinations in the payload (URLs, email addresses, and reverse-shell targets) to a canary sink on the reserved .invalid domain, canary.zeroleaks.invalid. If an exploit works and your agent calls a tool with the attacker's destination, the request goes to a host that cannot resolve, and the tool call is still recorded as evidence. The containment field on agent reports counts how many payloads were rewritten.

Loopback and cloud-metadata addresses (localhost, 127.0.0.1, 169.254.x.x) are left in place, because an SSRF probe against them tests your own infrastructure. Your tools still execute whatever the agent asks them to, against whatever dependencies you gave them, so containment does not replace scan-safe dependencies.

For runtime and endpoint scans, tools run in your process or behind your endpoint. ZeroLeaks does not execute them.

Dynamic availabilityCopy Anchor Link

If tools are selected dynamically, put the selection logic inside the wrapped production handler or AI SDK agent. The scan then observes the same per-step availability, approval rules, and execution behavior as normal traffic.