Skip to main content
ast-guard can transform validated code for safe execution. Transformations wrap dangerous operations with safe runtime proxies that enforce limits and provide isolation.

Basic Usage

Transformation Output

Transformation Options

Main Wrapper

The main wrapper enables top-level await and provides an entry point:
The runtime calls __ag_main() to execute the script.

Safe callTool

The callTool transformation proxies all tool calls through the runtime:
The __safe_callTool proxy:
  • Counts tool calls against maxToolCalls limit
  • Routes calls through the configured toolHandler
  • Sanitizes arguments and return values

Safe Loops

Loop transformations enforce iteration limits:

Safe Console

Console methods are proxied for rate limiting:
The __safe_console proxy:
  • Counts calls against maxConsoleCalls
  • Tracks output bytes against maxConsoleOutputBytes
  • Captures output for streaming to clients

Reserved Prefixes

The transformation reserves these prefixes that user code cannot use:
  • __ag_ - AgentScript internal identifiers
  • __safe_ - Safe runtime proxies
Any attempt to declare identifiers with these prefixes is blocked by the ReservedPrefixRule.

Custom Transformation

For advanced use cases, you can customize transformations:

Integration with enclave-vm

enclave-vm automatically applies transformations when transform: true (default):

Transformation Without Validation

You can transform code independently of validation: