paperclipai/paperclip · error · ToolContentValidationError

sensitive_value_blocked

sensitive_value_blocked

Error message

Tool content contains sensitive values

What it means

Sensitive-data guard in validateToolContent: the summarized tool payload contained redactable sensitive fields and sensitiveMode is block, so the content is rejected outright instead of being redacted. The tool arguments/result containing secrets/PII is at fault.

Source

Thrown at server/src/services/tool-content-guards.ts:237

  };
}

export function validateToolContent(input: {
  value: unknown;
  direction: "arguments" | "result";
  sensitiveMode?: "redact" | "block";
  promptInjectionMode?: "redact" | "block" | "ignore";
}) {
  const sensitiveMode = input.sensitiveMode ?? "redact";
  const promptInjectionMode = input.promptInjectionMode ?? (input.direction === "result" ? "block" : "ignore");
  const redactedValue = isPlainObject(input.value) ? redactEventPayload(input.value) : input.value;
  const redactedSummary = summarizeToolValue(redactedValue);
  const findings: string[] = [];

  if (redactedSummary.redactedFields?.length) {
    findings.push("sensitive_value");
    if (sensitiveMode === "block") {
      throw new ToolContentValidationError("Tool content contains sensitive values", "sensitive_value_blocked", findings);
    }
  }

  const promptFindings = promptInjectionMode === "ignore" ? [] : scanPromptInjection(input.value);
  if (promptFindings.length > 0) {
    findings.push(...promptFindings);
    if (promptInjectionMode === "block") {
      throw new ToolContentValidationError(
        "Tool result contained prompt-injection instructions and was blocked",
        "prompt_injection_blocked",
        promptFindings,
      );
    }
  }

  return {
    value: redactedValue,
    summary: redactedSummary,

View on GitHub (pinned to 01ad858492)

Solutions

1. Remove secrets/sensitive values from the tool content before sending; store them as connection credentials or environment secrets instead of inlining them.

When it happens

Trigger: Thrown at server/src/services/tool-content-guards.ts:225 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/655710abee561b53. Report an issue: GitHub.