Tool Call Interception

What it is

Tool call interception is the process of examining each tool call an AI agent generates, evaluating it against security policy, and deciding whether to allow, deny or observe it before the agent executes the call. The inspection happens between the LLM's response and the agent's execution layer.

A tool call is any request the agent makes to access external functionality: shell commands, API calls, file operations, database queries, or cloud service interactions. Each call is a potential attack surface.

Why it matters

Text-based safety filtering (evaluating the LLM's prose output) is insufficient for agents. Agents don't just generate text; they execute actions. An agent can generate a perfectly reasonable explanation and follow it with a tool call to delete critical infrastructure.

Tool call interception shifts the control boundary from text filtering to action enforcement. The LLM can reason however it wants; what matters is the action it attempts.

How it works

The proxy intercepts the LLM's response and parses the tool call blocks. For each tool call, the proxy evaluates the call against a deterministic deny-list of regex patterns covering shell injection, destructive deletion, privilege escalation, data exfiltration, API abuse, and more.

Each pattern maps to a policy label and a verdict: allow, deny, or observe. Example: the pattern \brm\b maps to a shell-rm policy and yields a deny verdict. A pattern matching a piped curl-to-shell install maps to a supply-chain-curl-bash policy and also yields a deny verdict.

The agent receives an assistant message naming the policy, in place of the call.

How Intercis implements it

Intercis maintains a deterministic deny-list of regex patterns, backed by an LLM classifier for execution-, file-mutating-, and MCP-tool calls the patterns do not decide. Each tool call on the LLM API wire is evaluated before it reaches the agent runtime and resolves to a verdict: allow, deny, or observe. In enforce mode a deny verdict blocks the call: the tool_use block is deleted from the response; in observe mode the same match is recorded without blocking. The patterns carry no per-pattern severity score, so nothing auto-terminates a session, and pending (a verdict reserved for actions that would need human review) has no live approve/deny action today. Tool calls the provider executes itself, for example hosted MCP tools, are outside this path: each one writes one observe row and is never evaluated.

The patterns cover: shell injection patterns, destructive file operations, privilege escalation attempts, data exfiltration sequences, API abuse, credential exposure, and process/network manipulation.