TamgaAgents
Coding agents and agent frameworks send the whole session to the model API in every request: the history, file contents, tool output. Point them at Tamga and each piece of text is scanned in its role, a poisoned tool result can be stripped while the session goes on, and a failed scan does not let tool traffic through.
No. 001STRIP
Blocking the request stops the attack and the session with it. STRIP replaces the whole tool result with a placeholder and forwards the rest, still applying every other rule.
An agent session, simulated
POST /anthropic/v1/messages
[Content removed by Tamga security policy.]
injection · role tool · rules.injection_detection
Under a STRIP rule the whole tool result is replaced, not the one sentence.
rules:
injection_detection: # in tool results: strip
action: STRIP
sensitivity: low
applies_to: [tool]
injection: # anywhere else: block
action: BLOCK
sensitivity: low
applies_to: [system, user, assistant, tool_definition, request]A false positive costs the model one tool result, which it can usually ask for again. That is cheaper than a false block, and it is still a cost: watch the STRIP events.
No. 002What is scanned
Tamga reads the request message by message and knows whether a piece of text is the user's prompt, a tool result, a tool description or the system prompt. A rule can be limited to some roles with applies_to.
No. 003Fail closed
A crashed check must not let an injected tool result through. Since v0.9.0 a request with tool results or tool definitions is refused when the scan fails, even under a policy that leaves the setting out.
scan.on_error: block
The shipped policy. If a scanner fails, runs past its deadline or is shed under load, the request gets 503 tamga_scan_unavailable with Retry-After: 1 and does not reach the provider. Most agents retry a 503.
key left out
A request that carries tool results or tool definitions fails closed with the same 503; a plain chat request is forwarded, marked X-Tamga-Scan-Degraded: true.
scan.on_error: pass
Forwards both, with less inspection than configured. Set it only if you accept that.
No. 004Set it up
Your Anthropic credential is sent as before and goes to the provider. The Tamga key stays at Tamga and decides which organisation the session is counted under.
export ANTHROPIC_BASE_URL="https://tamga.internal/anthropic"
export ANTHROPIC_CUSTOM_HEADERS="X-Tamga-Key: tk_your_key_here"client = anthropic.Anthropic(
base_url="https://tamga.internal/anthropic",
default_headers={"X-Tamga-Key": os.environ["TAMGA_KEY"]},
)No. 005Settings
The shipped policy is written for chat traffic. Scanning runs at about 250 KB a second per core and repeated text is answered from memory for ten minutes, so only the new part of each turn costs time.
No. 006Not yet