agentoolbox

A security rule set that checks shell commands and external web addresses before an agent uses them. It requires a separate Agent Toolbox check and gives each request a pass, flag, or block result.

In plain words
What is it for?
Use it to scan terminal commands and outbound URLs, stop commands marked BLOCK, explain flagged commands, and record the returned certificate hash for auditing.
Why use it?
It adds a review step before commands run or websites are contacted, helping stop blocked actions and making flagged actions visible to the user.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/solhammer/agentoolbox/agentoolbox
Clone the repo
git clone --depth 1 https://github.com/solhammer/agentoolbox
Per session 691 This file is loaded in full into every session.
When invoked 691 The same file — it is already loaded in full.
Security scan E 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00691 $0.00691
Opus 5 $0.00345 $0.00345
Sonnet 5 $0.00138 $0.00138
Haiku 4.5 $0.00069 $0.00069

Measured yesterday against content hash c8f0f3d5707b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade E, and why

agentoolbox scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Cloud metadata endpointhighServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

The endpoint 169.254.169.254 is the cloud metadata SSRF target — always BLOCK.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

-d '{"command":"rm -rf /tmp/build"}' | jq .verdict

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

**Example (REST fallback using curl):**
examples/cursor-rule/agentoolbox.mdc · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent Toolbox — Pre-Action Security Gate

Before executing any shell command or fetching any external URL, you MUST call the appropriate Agent Toolbox check. Do not skip this even for commands that appear safe.

Rules

Shell commands (Bash / terminal)

Before running ANY shell command (via terminal, subprocess, exec, etc.):

  1. Call scan_command (MCP tool) OR POST to https://api.agent-toolbox.ai/v1/scan/command with body { "command": "<the exact command string>" }.
  2. Check the verdict field in the response:
    • "PASS" → proceed.
    • "FLAG" → proceed, but tell the user what was flagged and why (from reason).
    • "BLOCK"DO NOT execute the command. Explain the block reason to the user and stop.
  3. Log the certificate.sha256 field from the response for auditability.

Example (REST fallback using curl):

curl -s -X POST https://api.agent-toolbox.ai/v1/scan/command \
  -H "Content-Type: application/json" \
  -d '{"command":"rm -rf /tmp/build"}' | jq .verdict

Outbound URLs

Before fetching, opening, or redirecting to any external URL:

  1. Call scan_url (MCP tool) OR POST to https://api.agent-toolbox.ai/v1/scan/url with body { "url": "<the exact URL>" }.
  2. Apply the same PASS / FLAG / BLOCK logic as above.
  3. Pay special attention to private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x). The endpoint 169.254.169.254 is the cloud metadata SSRF target — always BLOCK.

Example:

curl -s -X POST https://api.agent-toolbox.ai/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/api/data"}' | jq .verdict

MCP tool names (when agentoolbox-mcp is configured)

Action MCP tool REST endpoint
Gate a shell command scan_command POST /v1/scan/command
Gate an outbound URL scan_url POST /v1/scan/url
Gate a SQL query scan_sql POST /v1/scan/sql
Count tokens before sending count_tokens POST /v1/tokens/count

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 69 lines · 691 tokens per session scan E c8f0f3d5707b

Subscribe to this mod's changes

agentoolbox is a cursor rule published in the GitHub repository solhammer/agentoolbox (0 stars, last pushed 1mo ago), licensed MIT. It adds 691 tokens to every session, about $0.0035 per session on Opus 5. A static security scan graded it E with 3 findings (cloud metadata endpoint, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.