Tools and Side Effects

Runtime integrations include every configured tool by default. ZeroLeaks receives serializable definitions, while executable functions and provider credentials remain in your SDK process.

Complete definitions

Tool metadata supports:

interface AgentTool {
  name: string;
  description?: string;
  inputSchema?: unknown;
  outputSchema?: unknown;
  strict?: boolean;
  type?: string;
  providerOptions?: unknown;
  definition?: unknown;
}

The AI SDK adapter converts flexible schemas to JSON Schema automatically. OpenAI adapters preserve the original native tool object in definition and expose function parameters through inputSchema.

Execution traces

Reports can include:

• tool name and call ID;
• parsed arguments;
• returned value;
• thrown or returned errors;
• whether the provider executed the tool;
• the attack prompt and isolated scan session that produced the call.

This lets the evaluator distinguish an agent merely mentioning a dangerous command from an agent actually invoking a dangerous tool.

Production behavior versus production data

Use the same agent configuration and tool-control logic as production, but inject scan-safe dependencies whenever a tool can cause irreversible effects.

Recommended patterns:

• point database tools at an ephemeral database;
• use test tenants and credentials;
• route email, messaging, payments, and webhooks to sinks;
• preserve authorization and approval code paths;
• record intended side effects even when the final external action is intercepted;
• clean up state between scan runs.

ZeroLeaks does not silently disable tools because doing so would hide tool-hijacking vulnerabilities. The application controls whether the tool executor uses live or sandboxed dependencies.

Dynamic availability

If tools are selected dynamically, put the selection logic inside the wrapped production handler or AI SDK agent. The scan then observes the same per-step availability, approval rules, and execution behavior as normal traffic.