代理框架與安全
OpenAI Agents SDK 0.22.1 Pushes Guardrails Down to Tool and MCP Call Boundaries
The Python Agents SDK can now apply input and output guardrails to function tools and local MCP servers, with customizable replacement messages passed to the model when content is blocked. The release also reduces the host environment variables inherited by local sandboxes, although coverage still excludes hosted tools and built-in execution tools.
OpenAI released Agents SDK for Python 0.22.1 on September 8, extending the guardrail mechanism—which previously focused mainly on agent input and final output—to every tool call. Developers can configure input and output checks for function tools and attach rules at the server level for local `MCPServerStdio`, Streamable HTTP, or SSE servers. After the server filters the available tools, the rules apply to all MCP tools produced by the conversion process. Input guardrails can reject arguments or trigger a tripwire before execution, while output guardrails can inspect results, replace their contents with a data-free message, or halt execution. If a tool also requires human approval, input checks run again by default after approval and immediately before actual execution.
This change moves authorization decisions to the boundary where side effects occur, making it useful for intercepting credentials in arguments, prohibiting high-risk paths, or preventing MCP servers from returning sensitive data. `RunConfig.output_guardrail_blocked_message` can provide either fixed text or a formatting function, so the model does not need to see the rejected raw output. On the sandboxing side, Unix-local sessions now support `inherit_host_environment=False` and custom allowlists, preventing agent subprocesses from automatically inheriting the full host environment. Docker sessions can also be assigned labels, whose consistency is verified when a session is restored.
The limitations are equally important: tool-output checks happen after a call completes, so they cannot undo files already written, network requests already sent, or other external side effects. Hosted MCP and built-in tools such as `computer`, `shell`, and `apply_patch` also do not currently pass through this guardrail pipeline. Engineering teams should next verify which execution path each tool actually follows and supplement the SDK guardrails with fail-closed behavior, least-privilege permissions, and sandbox network policies.