FlagThis

Abstract

LLM agents increasingly rely on external tools to read files, call APIs, execute commands, and modify external services. This expands agent capability but introduces a new security boundary: third-party tools may appear benign at the interface level while embedding unsafe behavior in their implementations. Existing defenses are limited by weak evidence from tool metadata, scanner-style designs that collapse characterization and policy judgment into a single pre-use decision, and heuristic or LLM-based enforcement that may lack deterministic, auditable reasoning over task context and multi-tool composition. This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions through pre-admission vetting and task-aware runtime authorization. ToolGuardian uses progressive characterization to convert increasingly rich evidence into structured facts: descriptions capture declared intent, system-call traces expose coarse behavior, mock execution reveals observed effects, and source analysis identifies latent or conditional behavior. These facts describe capabilities, data access, communication, state mutation, provenance, and declaredversus-observed mismatches. ToolGuardians core contribution is an Answer Set Programming (ASP)-based declarative policy layer that reasons explicitly over capabilities, effects, task context, and composition. We compare ASP against heuristic and LLMbased policy realizations using the same inputs and output contract. We evaluate ToolGuardian on 16 MCP-style tools, including 8 malicious variants derived from real open-source tools, and 20 runtime scenarios covering atomic and composite workflows. For vetting, ASP reaches deny-class F1 of 0.86 and 88% accuracy using description, syscall, and observed-effect evidence. For runtime authorization, fully specified realizations classify all scenarios correctly, while ablations show that removing compositional and conformance rules substantially degrades performance.