"Tools & Sandboxing — Where the Agent Acts (Harness Series 4/6)"

The model reasons. The harness acts. A bad tool call can damage the user's system. This article covers the safety architecture around the action surface.

Series Roadmap (6 parts)

  1. What Is Harness Engineering?
  2. Context Engineering
  3. Memory Systems
  4. Tools & Sandboxing ← this article
  5. Multi-Provider Routing
  6. Evaluation & Ops

1. Tools = The Model's Hands

LLMs only reason. The hands — reading files, running commands, calling APIs — are separate components. Tools.

From the Claude Code analysis paper (arXiv 2604.14228): "When your agent reads a file, the harness decides whether the read is allowed, what happens to the result, and how much of the response fits in the next prompt. The model never touches the file system directly."

That's the foundational principle. The harness sits always between model and system.

2. Tool Specs — How a Model Calls Tools

Function Calling (OpenAI)

{
  "name": "read_file",
  "description": "Read a file from disk",
  "parameters": {
    "type": "object",
    "properties": {
      "path": {"type": "string"}
    }
  }
}

Tool Use (Anthropic)

Same structure, but responses include separate tool_use blocks. Used by Claude Code and Cursor.

MCP (Model Context Protocol)

  • Anthropic's protocol, released November 2024
  • A server exposes tools; any client can use them
  • Adopted by Claude Code, Cursor, and Codex CLI

Skills (CLAUDE.md pattern)

  • Encapsulates reusable procedures, not raw tools
  • Triggered by keywords
  • Used by Claude Code and OpenClaw

3. Permission Systems — What to Block

Claude Code: 7 permission modes + ML-based classifier (per arXiv 2604.14228)

Claude Code's 7-Mode System (2026)

  1. default — confirm every tool call
  2. acceptEdits — auto file edits, confirm rest
  3. bypassPermissions — auto everything (dangerous)
  4. plan — no tool use, planning only
  5. doNotAllow — explicit denylist
  6. allow — explicit allowlist
  7. dynamic — ML classifier decides safety

Permission Design Principles

  • Default deny, allow via whitelist
  • Directory-level isolation: /Users/foo/project/** allowed, ~/.ssh blocked
  • Bash commands matched by prefix: git status allowed, git push --force blocked

CLAUDE.md Permission Pattern

{
  "permissions": {
    "allow": ["Read(./**)", "Bash(git status)", "Bash(npm test:*)"],
    "deny": ["Read(~/.ssh/*)", "Bash(rm -rf:*)", "Bash(curl http*)"]
  }
}

4. Sandboxing — Levels of Isolation

4-1. Process Isolation

  • Tool runs in a separate process
  • The main agent process won't die
  • Lightweight, weak protection

4-2. Container (Docker)

  • Filesystem separation
  • Network policy possible
  • Memory/CPU limits
  • Per-tool spin-up is also viable

4-3. VM Isolation

Cursor 3 (April 2026): "Cursor Cloud Agents run autonomous coding tasks in isolated Linux VMs with full dev environments"

  • Full OS isolation
  • Strongest protection, heaviest
  • Becoming standard for cloud agents

4-4. Worktree (Git)

  • Same repo, separate branch directory
  • Main worktree untouched
  • Supported by Claude Code and Cursor 3

CLAUDE.md recommends: "execution: ... Use git worktree for risky changes."

5. Per-Tool Security Patterns

File Reads

  • Path validation (block ../)
  • Block symlink traversal
  • Size limits (large files chunked)

Bash Execution

  • Command allowlist
  • Pattern denylist (rm -rf /, fork bombs, sudo, etc.)
  • Timeout (default 2 minutes)
  • stdout/stderr size cap

Web Fetch / URL

  • Block localhost (SSRF prevention)
  • Block private IP ranges (10.x, 172.16.x, 192.168.x)
  • Force HTTPS
  • Redirect limit (loop prevention)

Database / API

  • Read-only credentials (when possible)
  • Rate limiting
  • Query timeout

6. MCP Security (April 2026)

MCP Servers Are External Code

  • Installing a third-party MCP server runs the server's code on your machine
  • Trust verification required
  • Prefer official servers (anthropic, openai, vercel, etc.)

MCP Token Limits (Claude Code)

  • Tool results capped at 25K tokens, warning at 10K
  • Server-opt-in up to 500K characters, persisted to disk
  • Prevents context blow-up

MCP Permission Delegation

When adding an MCP server, explicitly verify which tools it exposes. Don't auto-allow.

7. Hooks — Pre/Post Tool Guardrails

CLAUDE.md pattern: - PreToolUse(Bash|Write|Edit): input-stage guardrail. Block dangerous patterns + denied paths up front - PostToolUse(Edit|Write): detect debug statements + credential leaks

Claude Code hook system: 4 lifecycle events. Each runs user-defined shell commands.

Real Hook Examples

if [[ "$1" =~ "rm -rf" ]]; then
  echo "BLOCKED: rm -rf detected"
  exit 1
fi

if grep -q "API_KEY=" "$1"; then
  echo "WARNING: hardcoded credential"
fi

8. Isolation Level by Use Case

Use case Isolation Reason
Local personal project (single user) Process + permissions Light, sufficient
Team coding assistant (multi-user) Worktree + container Mistake isolation, fast
Cloud agent (untrusted code) VM Full isolation required
MCP server hosting Container per server Inter-server isolation
AutoML / Code Interpreter VM + network block Egress prevention

9. Failure Handling — Tool Loop Reliability

Tools fail. Network, permissions, missing file, timeout.

Failure Classification (CLAUDE.md docs/patterns/error-handling.md)

  • Transient (retry possible): transient network
  • Permanent (retry pointless): missing file, syntax error
  • Permission: needs more user authorization
  • Resource: out of tokens, disk full

Retry Policy

  • Transient: exponential backoff (1s → 2s → 4s, max 3 attempts)
  • Permanent: report immediately, try a different approach
  • Permission: hand back to user

3-Failure Circuit Breaker

CLAUDE.md: "execution: 3-failure circuit breaker → revisit architecture"

If the same tool fails 3×, rethink the strategy. Infinite retry just burns tokens for the same result.

10. Tool Output Handling

Big Results

  • 50K SQL rows → only first 100 in context, rest persisted to file
  • Model sees "Result has 100K rows in /tmp/result.csv. Schema: ..."
  • Additional tool calls fetch slices on demand

Parse Failures

  • Invalid JSON → return raw + error so the model can retry with more info
  • Retry uses a different representation (e.g., explicit schema)

Non-Deterministic Results

  • Same input, different output → caching impossible
  • Force determinism in the tool itself (random seed, fixed timestamp)

Bottom Line

Area Recommendation
Permissions Default deny + whitelist
Isolation Match risk (process → worktree → container → VM)
MCP Trust verification + token limits + explicit allow
Hooks PreToolUse / PostToolUse both
Failures Classify + exponential backoff + 3-failure circuit breaker

The single takeaway: "Models want to call tools. The harness's job is to define which tools and how to call them."

Part 5 (next) goes one level above tool calls — deciding which model handles which task: Multi-Provider Routing.

First-Party Sources

  • "Dive into Claude Code": arxiv.org/abs/2604.14228
  • Anthropic MCP spec: modelcontextprotocol.io
  • Cursor 3 cloud agents: cursor.com/cloud (April 2026)
  • Martin Fowler harness article: martinfowler.com/articles/harness-engineering.html

๋Œ“๊ธ€

๋Œ“๊ธ€ ์“ฐ๊ธฐ

์ด ๋ธ”๋กœ๊ทธ์˜ ์ธ๊ธฐ ๊ฒŒ์‹œ๋ฌผ

Agent Memory Engine (2/10) — Building an AI Agent Memory System with SQLite Alone

← 1/10 SQLite Memory Engine f… ๐Ÿ“š Series Index 3/10 memcore Completed → A memory engine that runs without daemons, without dependencies, anywhere ํ•ต์‹ฌ ์š”์•ฝ This post covers how to design an AI agent memory engine (memcore) on a single-file SQLite backend. - Structure: 25 modules, ~6,464 lines, 22 DB tables - Principles: no daemon, single-file portability, no required external dependencies, host-agnostic - Core techniques: 4-layer hybrid search (topic · vector · FTS5 · LIKE), U-tag dialectic-based confidence evolution, ingestion-layer bias rejection rules What This Post Covers One approach to building AI agent memory without a server or cloud vector DB. Specifically: (1) the limitations of text-file-based memory, (2) vector DB alternatives compared and selection criteria, (3) how to layer search tiers, (4) how to evolve confidence scores over time, and (5) how to block biased memory accumulation at the ingestion stage. Design Principles: Why Single-File SQLite Text-file-based ...
Read more »

"ML Foundations (9/9) — PyTorch vs TensorFlow, and the Road to Local LLMs"

์ด๋ฏธ์ง€
← 8/9 Deep Learning Architec… ๐Ÿ“š Series Index (series end) The final part. So far we've focused on models. Now we focus on the tools that actually run them . We'll lay out the philosophical difference between PyTorch and TensorFlow, and trace how Hugging Face transformers , llama.cpp , MLX , and Ollama built the bridge to running large language models on your own machine. By the end you should have the full mental model of "download a pretrained LLM and serve it locally." 0. Learning Objectives Explain the eager-vs-graph difference between PyTorch and TensorFlow. Explain, in graph terms, how autograd automates the backward pass. Use Hugging Face transformers ' AutoModel , AutoTokenizer , and pipeline abstractions. Describe llama.cpp's GGUF quantization, INT4 inference, and CPU-first flow. Describe Apple MLX's use of unified memory and how it differs from PyTorch. Run a local LLM with Ollama and call it through an OpenAI-compatible API. ...
Read more »

"RAG Core Study (14/26) — Evaluation Sets with RAGAS & DeepEval"

์ด๋ฏธ์ง€
Series overview: Series index ๐Ÿ“š Series Index Without an evaluation set, every RAG improvement is a story, not evidence. RAG systems fail in more than one place: retrieval, context selection, answer generation, and grounding. That means "looks better" is not a metric. Part 14 explains how to build a golden dataset , how RAGAS and DeepEval fit into the workflow, and why teams must separate retrieval quality from answer quality if they want tuning decisions to hold up. 0. Prerequisites Part 13 reranking — system quality now depends on multi-stage ranking. Part 1 grounding — a correct-looking answer is not enough. Part 12 Hybrid — multiple retrieval settings need comparison on fixed data. 1. Learning Objectives Build a small but useful golden dataset for RAG. Distinguish retrieval metrics from answer metrics . Use RAGAS and DeepEval in the right roles. Avoid the common traps in judge-model-based evaluation. 2. ํ•ต์‹ฌ ์š”์•ฝ An evaluation set for RAG is ...
Read more »

"ML Foundations (8/9) — Deep Learning Architectures: CNN, RNN, Attention"

์ด๋ฏธ์ง€
← 7/9 Deep Learning Training ๐Ÿ“š Series Index 9/9 PyTorch vs TensorFlow → What did we keep adding on top of an MLP? Vision went CNN, sequences went RNN/LSTM, and eventually both converged on Attention and the Transformer. Each architecture is easier to remember if you read it as what it gave up to gain something else . This part is the one-line summary of the decisive inflection points: LeNet → AlexNet → ResNet → LSTM → Attention → Transformer. 0. Learning Objectives Explain why CNN's convolution, pooling, and weight sharing match images so well. Trace what got unblocked from LeNet → AlexNet → VGG → ResNet as depth grew. State BPTT for RNNs and the vanishing/exploding gradient problem. Write the LSTM gate equations (forget, input, output) with intuition. Write the attention formula in query/key/value form and the scaled dot-product variant. State the precise reasons Transformers replaced RNNs (parallelism + long-range dependencies). 1. ํ•ต์‹ฌ ์š”์•ฝ CNN : weight sharin...
Read more »

"ML Foundations (7/9) — Deep Learning Training: Optimizers, Regularization, Initialization"

← 6/9 Neural Networks ๐Ÿ“š Series Index 8/9 Deep Learning Architec… → Building an MLP, as we did in Part 6, is not the same as getting it to train well . The right optimizer, regularization, initialization, and learning rate — when these line up, deep networks converge. When they don't, the network refuses to learn at all. This part is the catalog of those crafts, with formulas, paper citations, and code in one place. 0. Learning Objectives Compare and write the update rules for SGD, Momentum, Nesterov, and Adam. Explain how Dropout, BatchNorm, and LayerNorm work and where they belong in a model. Derive the variance formulas for Xavier and He initialization and match them to activations. Implement step, cosine, and warmup learning-rate schedules in PyTorch. Explain why gradient clipping is effectively required for RNNs and Transformers. Diagnose the most common training failures (NaN, plateau, overfitting) and apply first-line fixes. 1. ํ•ต์‹ฌ ์š”์•ฝ SGD : \(w \leftarro...
Read more »

OpenClaw to Hermes Migration (2/13) — What to Preserve, Partially Port, or Discard

← 1/13 Current Structure Inve… ๐Ÿ“š Series Index 3/13 What Moves to Hermes → A code review record classifying operational scripts into three tiers: preserve, partial-preserve, and discard. What This Post Covers An asset classification framework (preserve / partial-preserve / discard) for migrating a legacy agent system to a successor A concrete case applying the Strangler Fig + Subset Migration strategy to a memory pipeline Classification results evaluated across LOC, external dependencies, and replaceability axes A method for slimming down a bloated single file (1,310 LOC) using the migration as a natural entry point Problem Definition: Port Everything or Cut Deep? The OpenClaw inventory comprises multiple agents, multiple scheduler/daemon processes, and multiple operational scripts. When moving to the successor system, Hermes, the choice is not binary. A full port carries accumulated technical debt along with it; a minimal port discards hard-won domain logic. Code-revie...
Read more »

AI Agents I Built (5/7) — Building an Automated Blogger API Publishing System

← 4/7 My Life Organizer Agent ๐Ÿ“š Series Index 6/7 Dual → Designing a Markdown-Based Auto-Publish Pipeline with Blogger API v3 + OAuth 2.0 Key Summary Blogger API v3 + OAuth 2.0 enables a pipeline that converts Markdown files into publishable HTML posts blogger_publish.py handles the full flow — frontmatter parsing → body cleanup → HTML conversion → CSS injection → API post — in a single script For bulk publishing, quota management (delay, retry, TOC suppression) is the critical design concern Platform Selection Criteria API access is mandatory for AI agent-driven content publishing. A comparison of platforms: Platform API Cost AdSense Decision WordPress.com REST API Paid plan required Paid only Cost overhead Ghost REST API Self-hosted or paid Manual setup Ops overhead Blogger v3 API Free Native integration Adopted Blogger is free, exposes a REST API, and integrates natively with AdSense. For personal blog automation, this combination i...
Read more »