# dcl_evaluate_output_sanitizer FINAL-GATE Output Sanitizer ($0.02). Post-processing checkpoint that strips secrets/credentials, PII, crypto material (seed phrases, private keys, wallet addresses), internal network details (private IPs, MAC addresses, .internal/.local/.corp hostnames), and unsafe shell/SQL/path-traversal fragments from a raw model response — plus a narrow, high-precision safety net for direct self-harm-instruction-seeking and targeted-harassment phrasing (not a general toxicity classifier). Returns a single sanitized_output with every match replaced by [REDACTED]; use that instead of the original whenever verdict is NO_COMMIT. Run this as the LAST gate before a response reaches its destination — after dcl_evaluate_jailbreak_crypto/other input-side checks have already run, and immediately before dcl_commit seals the final decision. Internally re-uses the same detection tables as dcl_evaluate_secrets/dcl_evaluate_pii for the secrets/PII categories, so results stay consistent with those tools. Agent View of the PolicyLayer registry record for `dcl_evaluate_output_sanitizer`. HTML page: https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-output-sanitizer ## Facts - Tool: `dcl_evaluate_output_sanitizer` - Server: Dcl Trust Oracle (`https://mcp.fronesislabs.com/mcp`) — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle.md - Homepage: https://github.com/Fronesis-Labs/dcl-webhook - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server rate-limited: no - Parameters: 2 (2 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `agent_id` | string | yes | Identifier of the agent that produced the response. | | `response` | string | yes | The raw LLM/agent response to sanitize before it is delivered to a user, downstream agent, or external system. | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "dcl_evaluate_output_sanitizer", "arguments": { "agent_id": "", "response": "" } } } ``` ## Why dcl_evaluate_output_sanitizer is rated High Actively transforms and filters model output, executing redaction logic with broad data-altering effects. From the tool's own definition: "strips secrets, PII, crypto material, unsafe shell/SQL fragments" ## Use case AI agents invoke dcl_evaluate_output_sanitizer to trigger actions in Dcl Trust Oracle. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Dcl Trust Oracle: ```json { "version": "1", "default": "deny", "tools": { "dcl_evaluate_output_sanitizer": { "limits": [ { "counter": "dcl_evaluate_output_sanitizer_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on Dcl Trust Oracle (17) - `dcl_evaluate_strict` — Destructive — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-strict.md - `dcl_evaluate_jailbreak_crypto` — Execute — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-jailbreak-crypto.md - `dcl_pipeline_start` — Execute — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-pipeline-start.md - `dcl_evaluate_trade` — Financial — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-trade.md - `dcl_audit_decode` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-audit-decode.md - `dcl_audit_decode_deep` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-audit-decode-deep.md - `dcl_evaluate_batch` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-batch.md - `dcl_evaluate_fast` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-fast.md - `dcl_evaluate_jailbreak` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-jailbreak.md - `dcl_evaluate_mev` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-mev.md - `dcl_evaluate_pii` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-pii.md - `dcl_evaluate_quality` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-quality.md - `dcl_evaluate_safety` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-safety.md - `dcl_evaluate_secrets` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-secrets.md - `dcl_evaluate_wallet` — Read — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-wallet.md - `dcl_commit` — Write — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-commit.md - `dcl_evaluate_signal` — Write — https://policylayer.com/tools/com-fronesislabs-dcl-trust-oracle/dcl-evaluate-signal.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-fronesislabs-dcl-trust-oracle · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-fronesislabs-dcl-trust-oracle