inspectToolArguments (plugins/content-governance.ts)

Inspects tool arguments for credentials before sending to external services.

// Source: https://github.com/CopilotKit/OpenBot | License: MIT | Copyright 2026 CopilotKit
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Deterministic inspection of arguments before an MCP call leaves this deployment.
 *
 * This deliberately detects credentials, not general PII. A broad expression such as an email or
 * phone-number matcher would block ordinary connector work and turn a security boundary into a
 * source of false assurances. The findings contain only a category and a structural path: the
 * matched value must never be copied into an error, log, or audit row.
 */

export type SensitiveArgumentCategory =
  | "credential_field"
  | "private_key"
  | "provider_token"
  | "authorization_header";

export type SensitiveArgumentFinding = {
  category: Se

... (truncated -- full source via MCP)