What it is
Tool call interception is the process of examining every tool call an AI agent generates, evaluating it against security policy, and deciding whether to allow, deny, or escalate it before the agent executes the call. The inspection happens between the LLM's response and the agent's execution layer.
A tool call is any request the agent makes to access external functionality: shell commands, API calls, file operations, database queries, or cloud service interactions. Each call is a potential attack surface.
Why it matters
Text-based safety filtering (evaluating the LLM's prose output) is insufficient for agents. Agents don't just generate text — they execute actions. An agent can generate a perfectly reasonable explanation and follow it with a tool call to delete critical infrastructure.
Tool call interception shifts the control boundary from text filtering to action enforcement. The LLM can reason however it wants; what matters is the action it attempts.
How it works
The proxy intercepts the LLM's response and parses the tool call blocks. For each tool call, the proxy evaluates the call against a deterministic deny-list of 110 regex patterns covering shell injection, destructive deletion, privilege escalation, data exfiltration, API abuse, and more.
Each pattern maps to a policy label and a verdict: allow, deny, or observe. Example: the pattern \brm\b maps to a shell-rm policy and yields a deny verdict. The pattern curl\s[^|]*\|\s*(?:ba)?sh\b maps to a supply-chain-curl-bash policy and also yields a deny verdict.
The agent receives a structured response explaining the decision and why.
How Intercis implements it
Intercis maintains a deterministic deny-list of 110 regex patterns, backed by an LLM classifier for execution-, file-mutating-, and MCP-tool calls the patterns do not decide. Every tool call on the LLM API wire is evaluated before it reaches the agent runtime and resolves to a verdict: allow, deny, or observe. In enforce mode a deny verdict blocks the call — the tool_use block is deleted from the response; in observe mode the same match is recorded without blocking. The patterns carry no per-pattern severity score, so nothing auto-terminates a session, and pending (a verdict reserved for actions that would need human review) has no live approve/deny action today. Tool calls that never cross the LLM API wire — for example hosted MCP tools the provider executes directly — are outside this path today.
The patterns cover: shell injection patterns, destructive file operations, privilege escalation attempts, data exfiltration sequences, API abuse, credential exposure, and process/network manipulation.
Related terms
- AI Agent Proxy — The infrastructure that performs interception.
- AI Agent Policy Enforcement — The rules that guide interception decisions.