av_sandbox/lib.rs
1//! MCP Tool-Call & Action Sandbox (brief Module B).
2//!
3//! Intercepts JSON-RPC / MCP `tools/call` payloads inline, before they reach
4//! downstream tool servers, and produces an allow/deny verdict from four
5//! chained gates (all must pass, evaluated cheapest-first):
6//!
7//! 1. **Parse gate** — strict JSON-RPC 2.0 shape (a parser that never panics
8//! on arbitrary bytes, property-tested);
9//! 2. **Schema gate** — per-tool JSON Schema argument validation
10//! (schema-invalid payloads are blocked with an authorization error);
11//! 3. **Policy gate** — native Rust rules and/or WebAssembly policy modules
12//! executed in wasmtime with fuel + memory bounds (a hung or hostile
13//! policy cannot stall the pipeline);
14//! 4. **Budget gate** — atomic action budgets (per-tool
15//! `max_tool_calls["db_write"]: 3`, `max_payout_usd_micros:
16//! 50_000_000` = $50) via `av-state`.
17//!
18//! Every verdict is returned with machine-readable context so the harness can
19//! emit the per-call OCSF event (allowed or blocked, with budget consumption).
20
21pub mod policy;
22pub mod rpc;
23pub mod sandbox;
24
25pub use policy::{NativePolicy, PolicyDecision, PolicyEngine};
26pub use rpc::{parse_tool_call, RpcError, ToolCallRequest};
27pub use sandbox::{Sandbox, SandboxConfig, ToolVerdict};
28
29#[cfg(feature = "wasm")]
30pub mod wasm_policy;
31#[cfg(feature = "wasm")]
32pub use wasm_policy::WasmPolicy;