Should coding agents scan tool results before putting them into context?
A developer community discussion questions whether coding agents should scan tool results before integrating them into their context. The concern arises from agents accessing increasingly untrusted inputs like cloned repositories, README files, issue text, webpages, MCP responses, shell output, and arbitrary tool results, which are then directly fed back into the model's context. The discussion highlights particular interest in managing false positives and latency, and determining acceptable thresholds before such scanning features might be disabled.
Time & source
- Published
- 09/08, 19:09 UTC+0
- Ingested
- 09/09, 17:00 UTC+0
- Source type
- Dev community
- Tier
- Community
- Source status
- Healthy
Tier is a per-source editorial setting, not a per-item score.
Discussion trend
The percentage is based on collected discussion signal, not new comments or independent people. The curve only compares the same topic across time.
Something I've been wondering about with coding agents:
We give them access to increasingly untrusted inputs — cloned repos, README files, issue text, webpages, MCP responses, shell output and arbitrary tool results — and then usually put that text straight back into the model's context.
Would you use a harness plugin that inserts a security check in between?
Something like:
tool result → security hook → agent context
The hook runs a small semantic threat/injection scanner locally. If local capacity isn't enough, it can optionally fall back to an API with a free tier.
If it finds a suspicious section, it doesn't have to throw away the entire result. It can redact that section and let the coding agent continue working with everything else.
The next thing we're working on is keeping security context across multiple tool calls, rather than scanning every interaction as if it happened in isolation.
Would this be useful enough for you to install as a Codex plugin?
Or would adding another layer between tools and the agent create more problems than it solves?
I'm particularly interested in false positives and latency — what would be acceptable before you'd just disable it?