Proposal: Runtime Verification Component for Tool Call Safety

[Correctover]

Summary

We'd like to propose integrating CCS runtime verification as a pipeline component in Haystack's tool execution chain, and invite maintainers to evaluate feasibility.

What CCS Does

CCS intercepts and verifies every tool call before execution:

• RCE detection — blocks shell injection, command chaining
• SSRF protection — validates outbound URLs against allowlists
• Credential hijack prevention — detects token/secret exfiltration
• Overhead: ~22μs per check (P50), deterministic

Integration Point

Haystack's pipeline component architecture supports wrapping patterns:

from haystack.components.tools import ToolInvoker
from correctover_ccs import CCSVerifiedToolInvoker

# Wrap the tool invoker with CCS verification
safe_invoker = CCSVerifiedToolInvoker(ToolInvoker())
pipeline.add_component("tool_invoker", safe_invoker)

How It Complements Haystack's Architecture

Component	Scope
Existing components	RAG, retrieval, generation
CCS Component (proposed)	Pre-execution security verification

CCS adds a security dimension without changing the pipeline contract — it's a drop-in component.

Background

• Published research: DOI: 10.5281/zenodo.17164296
• Active in governance across CrewAI, AutoGen, Semantic Kernel, LangGraph
• 87+ CVEs/ZDI submissions across AI agent frameworks

Ask

1. Is there appetite for a security verification component?
2. Does the component wrapper pattern fit, or is there a better approach?
3. Any concerns about pipeline compatibility?

Happy to provide a PoC component.

— Correctover team | correctover.com | Correctover = AI Reliability™