Crate av_sandbox 

MCP Tool-Call & Action Sandbox (brief Module B).

Intercepts JSON-RPC / MCP tools/call payloads inline, before they reach downstream tool servers, and produces an allow/deny verdict from four chained gates (all must pass, evaluated cheapest-first):

1. Parse gate — strict JSON-RPC 2.0 shape (a parser that never panics on arbitrary bytes, property-tested);
2. Schema gate — per-tool JSON Schema argument validation (schema-invalid payloads are blocked with an authorization error);
3. Policy gate — native Rust rules and/or WebAssembly policy modules executed in wasmtime with fuel + memory bounds (a hung or hostile policy cannot stall the pipeline);
4. Budget gate — atomic action budgets (per-tool max_tool_calls["db_write"]: 3, max_payout_usd_micros: 50_000_000 = $50) via av-state.

Every verdict is returned with machine-readable context so the harness can emit the per-call OCSF event (allowed or blocked, with budget consumption).

Re-exports

pub use denial_code::DenialCode;

pub use policy::NativePolicy;

pub use policy::PolicyDecision;

pub use policy::PolicyEngine;

pub use rpc::parse_tool_call;

pub use rpc::refuse_duplicate_json_keys;

pub use rpc::RpcError;

pub use rpc::ToolCallRequest;

pub use sandbox::Sandbox;

pub use sandbox::SandboxConfig;

pub use sandbox::ToolVerdict;

pub use wasm_policy::WasmPolicy;

Modules

denial_code

Structured denial codes for tool-call authorization failures.

policy

Policy engines: the trait + native Rust rules.

rpc

JSON-RPC 2.0 / MCP tools/call parsing. Total: never panics on arbitrary bytes (property-tested), returns typed errors for every malformed shape.

sandbox

The sandbox pipeline: parse → schema → policy → budget, with timing.

wasm_policy

WebAssembly policy modules via wasmtime (the sandboxing engine).