DESIGN.md@examples/tool_safetyC
DESIGN.md@examples/tool_safety from trpc-group/trpc-agent-python is a DESIGN.md file: the design rules coding agents follow in that repo.
mdr add trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md@git:20260731.fa1428fPins git:20260731.fa1428f in mdr.lock. Pin the fingerprint instead.
- Audit grade
- C, 12 of 14 checks passed
- Kind
- DESIGN.md file
- Repository
- trpc-group/trpc-agent-python
- Path
examples/tool_safety/DESIGN.md- Versions recorded
- 5
- Latest version
- git:20260731.1153e7f, committed Jul 31, 2026
- First version recorded
- Jul 31, 2026
- Size
- 16,713 bytes
- Repository stars
- 147
- License
- a license file GitHub does not identify
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Tool Script Safety Guard 设计文档
本文档说明 Tool Script Safety Guard 的请求处理流程，以及遇到不同风险程度命令时的决策和执行结果。
## 设计目标
Tool、Skill、MCP Tool 和 CodeExecutor 都可能执行脚本、shell 命令、外部进程或网络请求。Safety Guard 的目标是在真实执行前完成静态扫描和策略判断，把明显危险的请求拦截在执行边界外，并为不确定请求提供人工复核、审计和 telemetry 信息。
实现保持向后兼容：`BashTool` 和 `UnsafeLocalCodeExecutor` 默认不改变历史行为，只有显式设置 `enable_safety_guard=True` 后才启用扫描。`deny` 默认阻断执行；`needs_human_review` 默认记录但不阻断，设置 `block_on_review=True` 后也会阻断。
## 请求处理流程
```text
Tool / Skill / MCP Tool / CodeExecutor request
|
v
提取待执行内容
script / code / command / cmd / code_blocks
language / command_args / cwd / env / tool_metadata
|
v
ToolScriptScanRequest
|
v
ToolScriptSafetyScanner.scan()
|
+--> 语言归一化: python / bash / unknown
+--> 脱敏检测: script 和 env 中的 key/token/password/private_key
+--> Python AST 规则: open、Path、subprocess、os.system、requests、socket、eval、while True
+--> Bash 规则: rm、curl、wget、token 环境变量输出、敏感路径、管道、重定向、命令替换、依赖安装、sudo、sleep、fork bomb
+--> 执行上下文规则: cwd、timeout、max_output_bytes、command_args
+--> 用户注册规则: ToolScriptSafetyScanner.custom_rules / register_rule()
|
v
命中 RiskFinding 列表
…Read the whole file at its exact version.
How to install
mdr add trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md@sha256:87cada287f0d8ca0The line at the top of this page pins the label git:20260731.fa1428f, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_mq3zufs7fxomtqmn)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, all committed on Jul 31, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260731.1153e7f latest | 2026-07-31 | 1153e7f | 16,713 B | C | view · diff |
| git:20260731.2478d9c | 2026-07-31 | 2478d9c | 16,646 B | C | view · diff |
| git:20260731.273cf2d | 2026-07-31 | 273cf2d | 12,306 B | C | view · diff |
| git:20260731.93d7c1c | 2026-07-31 | 93d7c1c | 16,707 B | C | view · diff |
| git:20260731.fa1428f | 2026-07-31 | fa1428f | 16,776 B | C | view |
Audit of the latest version
- fail: No curl or wget piped into a shell (matched: curl ... \| sh)
- fail: No instruction to read or print local credentials (matched: cat .env)
- pass: Size between 200 bytes and 200 KB (16713 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No recursive delete of root, home or parent
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for DESIGN.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
trpc-group/trpc-agent-python · 147 stars · license a license file GitHub does not identify · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mq3zufs7fxomtqmn GET https://markdownregistry.com/api/v1/resolve?ref=trpc-group/trpc-agent-python/examples/tool_safety/DESIGN.md GET https://markdownregistry.com/api/v1/blob/87cada287f0d8ca03addd22cc62c553aaef111f1dc5c42378dd76d1cc4093e0f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: what DESIGN.md is and how agents use it · which agent file does what.