llm orchestration capability stripping via prompt injection
Intercepts and modifies LLM prompts to remove or restrict orchestration directives, function-calling permissions, and tool-use capabilities before they reach the model. Works by parsing incoming prompts, identifying orchestration-related instructions (tool invocation, workflow control, agent loops), and either stripping them entirely or replacing them with constrained versions that prevent unauthorized execution. Uses pattern matching and instruction rewriting to maintain semantic intent while removing dangerous orchestration primitives.
Unique: Specifically targets orchestration and tool-calling capabilities rather than general content filtering — uses instruction-level analysis to surgically remove function invocation, agent loops, and workflow control directives while preserving legitimate prompt semantics
vs alternatives: More granular than generic content filters (which block broad categories) and more focused than full jailbreak defenses, enabling teams to selectively disable orchestration while keeping other LLM capabilities intact
cli-based prompt transformation and validation pipeline
Provides a command-line interface for batch processing prompts through a transformation pipeline that validates, modifies, and logs changes to LLM instructions. Accepts prompts as input (via stdin, files, or API), applies orchestration stripping rules, validates the output against a policy schema, and returns sanitized prompts with detailed change logs. Implements a composable filter chain architecture where each stage (detection, stripping, validation, logging) can be independently configured or extended.
Unique: Implements a composable filter-chain architecture where orchestration stripping, validation, and logging are independent stages that can be reordered or extended — enables teams to build custom sanitization pipelines without modifying core code
vs alternatives: More flexible than monolithic content filters and more automation-friendly than manual prompt review, with explicit audit trails suitable for compliance-heavy industries
orchestration capability detection and classification
Analyzes prompts to identify and classify different types of orchestration directives (tool-calling, function invocation, agent loops, workflow control, multi-step planning). Uses pattern recognition and semantic analysis to detect both explicit orchestration instructions (e.g., 'call the weather API') and implicit ones (e.g., 'use available tools to solve this'). Classifies detected capabilities by type and severity, enabling fine-grained policy decisions about which to allow, restrict, or remove.
Unique: Focuses specifically on orchestration-layer capabilities rather than general content or toxicity — uses domain-specific pattern libraries tailored to tool-calling APIs, agent frameworks, and workflow orchestration systems
vs alternatives: More precise than generic prompt analyzers because it understands the specific semantics of orchestration directives (function schemas, tool invocation syntax, agent loop patterns) rather than treating them as generic text
policy-driven capability allowlist/denylist enforcement
Enforces user-defined policies that specify which orchestration capabilities are allowed, restricted, or forbidden in prompts. Policies are defined as configuration files (YAML/JSON) that map capability types to enforcement actions (allow, restrict, deny). During prompt processing, the system checks detected capabilities against the policy and either permits them, applies restrictions (e.g., rate limiting, approval gates), or blocks them entirely. Supports role-based policies where different users or contexts have different capability allowances.
Unique: Implements a declarative policy language specifically for orchestration capabilities rather than generic content policies — enables fine-grained control over tool-calling, function invocation, and agent behavior without requiring code changes
vs alternatives: More flexible than hard-coded capability restrictions and more maintainable than custom filtering logic, with explicit policy versioning and audit trails suitable for compliance documentation
prompt rewriting with orchestration constraints
Automatically rewrites prompts to add explicit constraints on orchestration capabilities, converting unrestricted orchestration requests into bounded versions. For example, converts 'use any available tools to solve this' into 'use only the following tools: [list] and make at most 3 function calls'. Uses template-based rewriting that preserves the original intent while adding safety boundaries. Supports custom rewrite rules that can be tailored to specific LLM models or use cases.
Unique: Focuses on adding explicit orchestration constraints rather than removing capabilities entirely — uses template-based rewriting that preserves intent while bounding resource usage and function call depth
vs alternatives: More permissive than outright capability stripping while still providing safety guarantees, enabling teams to use orchestration features with explicit resource and behavioral boundaries