Quick Start
1
Simple Usage
Built-in search tools are protected automatically:
2
With Configuration
Mark custom tools as external:
How It Works
Auto-protected built-ins includeduckduckgo, web_search, tavily_search, scrape_page, fetch_url, and others in the external tools set. MCP tools can be marked at registration time.
Outbound tool results are wrapped in <external_tool_result>; inbound webhook and hook payloads are wrapped in <external_request_payload> — same idea, opposite direction. See Untrusted Request Fencing for the ingress boundary.
Configuration Options
Best Practices
Mark external data sources as external
Mark external data sources as external
Web APIs, scraping, MCP servers you do not control, and third-party feeds should use
trust_level="external".Do not strip safety markers
Do not strip safety markers
Removing
<external_tool_result> tags breaks the model’s boundary between data and instructions.Prefer external when unsure
Prefer external when unsure
Wrapping cost is minimal; under-marking exposes you to injection.
Layer with other guards
Layer with other guards
Combine with Tool Circuit Breaker and input validation for defence in depth.
Related defence. Tool outputs get wrapped in
<external_tool_result> markers (this page). Inbound webhook and hook payloads get the ingress counterpart — wrapped in <external_request_payload>, described in Untrusted Request Fencing. Platform display names and group titles interpolated into the [{sender}] attribution prefix get a different treatment — collapse-and-strip — described in Sender Attribution Sanitisation.Related
Untrusted Request Fencing
The ingress counterpart — webhook and hook payloads fenced as data
Attribution Sanitisation
Neutralise untrusted platform display names in the prompt prefix
Tool Circuit Breaker
Automatic tool failure detection and recovery
Security Overview
Complete security features and best practices

