Built a zero-latency AST bouncer for local agent tool-calling

ivegotahunnitonit — Wed, 02 Sep 2026 07:27:27 +0000

Hey everyone,

Like many of you, we got frustrated with the current state of safety guardrails for autonomous agents.

When you're running local LLMs (via Ollama, vLLM, or LM Studio) to execute bash scripts or database queries, calling a remote cloud moderation endpoint (Bedrock, OpenAI Moderation) defeats the entire purpose of running locally:

It adds 1,500ms–2,500ms of cloud latency to every single tool invocation.
It breaks the air-gap / local privacy guarantee.
LLM-as-a-judge evaluators are still susceptible to jailbreaks.

The Approach: Deterministic Compiler AST Invariants

Instead of asking another model if a proposed command is safe, we built an in-process Abstract Syntax Tree (AST) evaluator that parses Python, SQL, and Bash code blocks directly in caller memory before execution.

If an agent attempts:

Catastrophic filesystem deletes (rm -rf, mkfs, raw device writes)
Database DDL purges (DROP TABLE, TRUNCATE)
Dynamic Python sandbox breakouts (().__class__.__base__.__subclasses__())
Unauthorized reads of sensitive paths (/etc/shadow, .env, id_rsa)
High-entropy credential exfiltration (AWS keys, OpenAI keys, GitHub PATs)

The tool execution is aborted in under 40 microseconds (<0.00004s) directly inside Python memory, with zero OS syscalls spawned.

Usage

It's published on PyPI as btp-guard:


bash
pip install btp-guard

Stop Calling Cloud APIs to Guard AI Agent Tools: How to Gate Commands in Under 50µs

ivegotahunnitonit — Wed, 02 Sep 2026 07:25:11 +0000

If you've built autonomous agents with CrewAI, LangGraph, or Microsoft AutoGen, you know that giving an LLM access to bash tools or database queries is genuinely terrifying.

A single jailbreak, prompt injection, or weird hallucination can run:


bash
rm -rf /
DROP TABLE production_users;
().__class__.__base__.__subclasses__() # Sandbox breakout

DEV Community: ivegotahunnitonit

Built a zero-latency AST bouncer for local agent tool-calling

The Approach: Deterministic Compiler AST Invariants

Usage

Stop Calling Cloud APIs to Guard AI Agent Tools: How to Gate Commands in Under 50µs