ModelFuzz

An agent that calls tools is only as safe as the arguments it passes to them. ModelFuzz addresses this by sitting between the LLM’s decision and the function that executes it. The core workflow is a Python decorator: wrap any tool function with `@shield_tool`, define your policies, and any call that violates those policies raises a `ModelFuzzBlockError` before the underlying function runs. Installation is `pip install modelfuzz`; no hosted dependency is required at runtime.

The differentiating feature is the pairing of offense and defense in one package. The CLI scanner — `modelfuzz scan` — accepts an OpenAI-compatible endpoint and model name, fires a suite of indirect prompt-injection payloads, and reports which ones successfully tricked the agent into executing a tool. That output is a direct map of your attack surface before you deploy shields. Most security libraries pick one side; ModelFuzz lets you find the holes with the scanner, then seal them with the decorator, in the same tool.

The library fits cleanly into codebases where tool functions are discrete Python callables — a `send_email`, an `http_post`, a `shell.run`. The enforcement happens at argument inspection: the blocked example in the docs catches `’secret’` as a sensitive keyword in an outbound email body. That works for known-bad patterns, but policy coverage is only as good as the rules you write. Teams encountering novel exfiltration paths — encoded payloads, indirect channels, arguments that split sensitive content across fields — will need to write and maintain custom rules. The hosted dashboard with centralized policy management and team-level audit logs is listed as a waitlist feature and is not publicly available, so multi-agent deployments today manage policy files per codebase.