{"record":{"id":"655710abee561b53","repo":"paperclipai/paperclip","slug":"sensitive-value-blocked","errorCode":"sensitive_value_blocked","errorMessage":"Tool content contains sensitive values","messagePattern":"Tool content contains sensitive values","errorType":"validation","errorClass":"ToolContentValidationError","httpStatus":502,"severity":"error","filePath":"server/src/services/tool-content-guards.ts","lineNumber":237,"sourceCode":"  };\n}\n\nexport function validateToolContent(input: {\n  value: unknown;\n  direction: \"arguments\" | \"result\";\n  sensitiveMode?: \"redact\" | \"block\";\n  promptInjectionMode?: \"redact\" | \"block\" | \"ignore\";\n}) {\n  const sensitiveMode = input.sensitiveMode ?? \"redact\";\n  const promptInjectionMode = input.promptInjectionMode ?? (input.direction === \"result\" ? \"block\" : \"ignore\");\n  const redactedValue = isPlainObject(input.value) ? redactEventPayload(input.value) : input.value;\n  const redactedSummary = summarizeToolValue(redactedValue);\n  const findings: string[] = [];\n\n  if (redactedSummary.redactedFields?.length) {\n    findings.push(\"sensitive_value\");\n    if (sensitiveMode === \"block\") {\n      throw new ToolContentValidationError(\"Tool content contains sensitive values\", \"sensitive_value_blocked\", findings);\n    }\n  }\n\n  const promptFindings = promptInjectionMode === \"ignore\" ? [] : scanPromptInjection(input.value);\n  if (promptFindings.length > 0) {\n    findings.push(...promptFindings);\n    if (promptInjectionMode === \"block\") {\n      throw new ToolContentValidationError(\n        \"Tool result contained prompt-injection instructions and was blocked\",\n        \"prompt_injection_blocked\",\n        promptFindings,\n      );\n    }\n  }\n\n  return {\n    value: redactedValue,\n    summary: redactedSummary,","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-content-guards.ts#L219-L255","documentation":"Sensitive-data guard in validateToolContent: the summarized tool payload contained redactable sensitive fields and sensitiveMode is block, so the content is rejected outright instead of being redacted. The tool arguments/result containing secrets/PII is at fault.","triggerScenarios":"Thrown at server/src/services/tool-content-guards.ts:225 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove secrets/sensitive values from the tool content before sending; store them as connection credentials or environment secrets instead of inlining them."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}