CAIN-42 CAIN StudioRecipes
Guard files
For an agent that writes files, in 17 frameworks.
Last reviewed 2026-10-02
Writing SSH keys is refused; writing to the agent's own output folder runs.
The rule
{
"name": "files-guard",
"effect": "deny",
"priority": 10,
"match_path": "/tools/write_file",
"conditions": [
{
"field": "path",
"op": "matches",
"value": "*/.ssh/*"
}
]
}Measured on production (2026-10-02, rule tester): the risky call below matches this rule and the safe one does not.
| Risky | {"path": "/home/app/.ssh/authorized_keys", "content": "ssh-ed25519 AAAA..."} |
|---|---|
| Safe | {"path": "/srv/app/out/report.csv", "content": "a,b"} |
Pick your framework
| Framework | Tool name CAIN sees | Plugs into |
|---|---|---|
| Python (any function) | write_file | the function that acts |
| LangChain | write_file | your agent's tool list |
| LangGraph | write_file | the tools your graph's nodes call |
| OpenAI Agents SDK | write_file | function tools |
| CrewAI | write_file | CrewAI's before-tool-call hooks |
| LlamaIndex | write_file | FunctionTool |
| Pydantic AI | write_file | an agent capability |
| AutoGen (agentchat) | write_file | the callables you give AssistantAgent |
| Google ADK | write_file | the functions in an agent's tools |
| Claude Agent SDK | mcp__ops__write_file | PreToolUse hooks |
| MCP client (Python) | write_file | any MCP client session |
| OpenTelemetry | write_file | your existing tracing |
| Any other framework | write_file | any Python callable |
| Claude Code hooks | Write | Claude Code's PreToolUse hook |
| Cursor hooks | read_file | Cursor's permission hooks |
| TypeScript / JavaScript | write_file | any async function |
| HTTP (any language) | write_file | your own call site |
Try CAIN-42 on your own agents
Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.
Create a free account → · Try the sandbox · See the whole ecosystem