Redact / Block Tool Output

Scrub secrets or block tool results before they reach the model

Plugins rewrite or block what a tool returns before the model ever sees it — so a leaked API key from a fetch tool or a PII field from a database lookup is scrubbed at the plugin layer, without changing the tool.

Quick Start

1. Redact secrets

   Create ~/.praisonai/plugins/redact_secrets.py:

   """
   Plugin Name: Redact Secrets
   Description: Scrub API keys from any tool output
   Version: 1.0.0
   """
   
   import re
   from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook
   
   class RedactSecrets(Plugin):
       @property
       def info(self):
           return PluginInfo(name="redact_secrets", hooks=[PluginHook.AFTER_TOOL])
   
       def after_tool(self, tool_name, result):
           return re.sub(r"sk-[A-Za-z0-9]{16,}", "[REDACTED]", str(result))

   Load it and run any agent — the plugin fires on every tool call:

   from praisonaiagents import Agent, discover_and_load_plugins
   
   discover_and_load_plugins()
   
   agent = Agent(
       name="Assistant",
       instructions="Help the user",
       tools=["fetch"],
   )
   agent.start("Fetch https://api.example.com/whoami")

   The model receives token=[REDACTED] ok instead of token=sk-SECRET1234567890 ok.

2. Block on secret

   Create ~/.praisonai/plugins/block_on_secret.py:

   """
   Plugin Name: Block On Secret
   Description: Suppress any tool output that leaks a secret
   Version: 1.0.0
   """
   
   from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook, PluginDecision
   
   class BlockOnSecret(Plugin):
       @property
       def info(self):
           return PluginInfo(name="block_on_secret", hooks=[PluginHook.AFTER_TOOL])
   
       def after_tool(self, tool_name, result):
           if "sk-" in str(result):
               return PluginDecision.deny("Secret detected in tool output")
           return None  # passthrough

   The tool still runs, but the model is told the output was blocked and never sees the leaked value.

How It Works

The after_tool hook fires once the tool returns, before the result reaches the model — on both chat() and achat().

Common Patterns

Regex secret scrubbing

Replace anything matching a secret pattern before it reaches the model.

import re
from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook

PATTERNS = [
    r"sk-[A-Za-z0-9]{16,}",           # OpenAI-style keys
    r"ghp_[A-Za-z0-9]{36}",           # GitHub tokens
    r"\b\d{3}-\d{2}-\d{4}\b",         # US SSN
]

class ScrubSecrets(Plugin):
    @property
    def info(self):
        return PluginInfo(name="scrub_secrets", hooks=[PluginHook.AFTER_TOOL])

    def after_tool(self, tool_name, result):
        text = str(result)
        for pattern in PATTERNS:
            text = re.sub(pattern, "[REDACTED]", text)
        return text

Allowlist-only fields

Return only the fields you trust from a structured tool result.

from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook

ALLOWED = {"id", "name", "status"}

class AllowlistFields(Plugin):
    @property
    def info(self):
        return PluginInfo(name="allowlist_fields", hooks=[PluginHook.AFTER_TOOL])

    def after_tool(self, tool_name, result):
        if isinstance(result, dict):
            return {k: v for k, v in result.items() if k in ALLOWED}
        return None

Block with the exception form

Raise GuardrailBlocked from deep inside a validator that already raises.

from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook, GuardrailBlocked

class BlockPII(Plugin):
    @property
    def info(self):
        return PluginInfo(name="block_pii", hooks=[PluginHook.AFTER_TOOL])

    def after_tool(self, tool_name, result):
        if "ssn=" in str(result):
            raise GuardrailBlocked("PII detected in tool output")
        return None

Tool-name filtering

Scope the scrub to one tool and skip the rest — the cheapest possible passthrough.

from praisonaiagents.plugins import Plugin, PluginInfo, PluginHook

class RedactFetchOnly(Plugin):
    @property
    def info(self):
        return PluginInfo(name="redact_fetch_only", hooks=[PluginHook.AFTER_TOOL])

    def after_tool(self, tool_name, result):
        if tool_name != "fetch":
            return None
        return str(result).replace("sk-SECRET1234567890", "[REDACTED]")

Best Practices

Related