I maintain attenu-guard.
Preflight Checklist
- I have searched existing cookbooks and this topic isn't already covered
- This proposal focuses on Claude API/SDK capabilities (not external frameworks)
- I am prepared to implement this cookbook (or have a clear implementation plan)
Problem Statement
A parent's subagent tools are typed by hand into its AgentDefinition. No cookbook derives that list from the parent's own list and denies the rest before the tool runs.
Claude Capabilities Demonstrated
AgentDefinition.tools and a PreToolUse hook returning deny. Side-effect flags show the refused body never ran.
Differentiation
#384 asked for five things and was closed as not planned. Two open PRs sit near it: #400 keeps that broad scope, #470 signs a provenance chain across hops. This is one pattern on the Agent SDK's own handoff: the child's tool list, derived, and denied outside it.
Additional Context
Run once on anthropics/commerce-agents, which takes no contributions: write-up, recipe.
One question. The enforcement can be the SDK's own hooks alone, or attenu-guard (examples/integrations/claude_sdk/). #384's close asked for notebooks "standalone and not require or promote external dependencies". Does that rule out the library version?
Activity
0No activity yet.