docs: add security warnings to http_request and file_editor vended tools#2391
docs: add security warnings to http_request and file_editor vended tools#2391zastrowm wants to merge 2 commits into
Conversation
Documentation Preview ReadyYour documentation preview has been successfully deployed! Preview URL: https://d3ehv1nix5p99z.cloudfront.net/pr-cms-2391/docs/user-guide/quickstart/overview/ Updated at: 2026-05-29T23:24:03.347Z |
|
Assessment: Approve Clean documentation-only PR that adds important security guidance to the |
|
Assessment: Approve Clean, well-structured documentation addition. The security warnings are consistent with the existing bash tool pattern, factually accurate, and appropriately scoped for each tool's risk profile. No issues found. |
The Bash vended tool has an explicit security warning, but the http_request and file_editor tools were missing equivalent guidance despite also crossing important security boundaries. Add comparable warnings to their READMEs and the vended-tools documentation page.
Remove references to allowlists, URL filtering, and path restrictions since the SDK does not provide those capabilities. Keep the guidance focused on sandboxing (containers, VMs) as the mitigation path.
zastrowm
force-pushed
the
tool-doc-updates
branch
from
1df2ecc to
e4a37fa
Compare
|
Assessment: Approve Well-scoped documentation PR that adds security warnings to |
1 participant
Motivation
The Bash vended tool includes an explicit security warning in both its README and the vended-tools documentation page, but the
http_requestandfile_editortools lack equivalent guidance despite also crossing important security boundaries (arbitrary network access and arbitrary filesystem writes, respectively). This adds comparable warnings so users understand the risks when exposing these tools to agents.Public API Changes
No public API changes. Documentation only.