Should coding agents scan tool results before putting them into context?

Something I've been wondering about with coding agents:

We give them access to increasingly untrusted inputs — cloned repos, README files, issue text, webpages, MCP responses, shell output and arbitrary tool results — and then usually put that text straight back into the model's context.

Would you use a harness plugin that inserts a security check in between?

Something like:

tool result → security hook → agent context

The hook runs a small semantic threat/injection scanner locally. If local capacity isn't enough, it can optionally fall back to an API with a free tier.

If it finds a suspicious section, it doesn't have to throw away the entire result. It can redact that section and let the coding agent continue working with everything else.

The next thing we're working on is keeping security context across multiple tool calls, rather than scanning every interaction as if it happened in isolation.

Would this be useful enough for you to install as a Codex plugin?

Or would adding another layer between tools and the agent create more problems than it solves?

I'm particularly interested in false positives and latency — what would be acceptable before you'd just disable it?