智能体隔离栈的第一层：每次工具调用都在临时容器中执行，工作区以外的路径一律拒绝并记录为安全事件。

完整 FlowZap 代码

将以下 FlowZap 代码复制并粘贴到您的 FlowZap 账户的项目中，即可查看此模板图。

agent { # Agent
n1: circle label:"Session Start"
n2: rectangle label:"Request Tool Call"
n5: rectangle label:"Process Result"
n6: circle label:"Session End"
n1.handle(right) -> n2.handle(left)
n2.handle(bottom) -> sandbox.n3.handle(top) [label="tool call"]
}

sandbox { # Sandbox
n3: diamond label:"Path in Workspace?"
n4: rectangle label:"Execute in Ephemeral Container"
n7: rectangle label:"Deny - Log Security Event"
n8: rectangle label:"Return Result to Agent"
n3.handle(right) -> n4.handle(left) [label="yes"]
n3.handle(bottom) -> n7.handle(top) [label="no"]
n4.handle(right) -> n8.handle(left)
n7.handle(right) -> n8.handle(bottom)
n8.handle(top) -> agent.n5.handle(bottom) [label="result"]
n5.handle(right) -> n6.handle(left)
}

安装 MCP 包npm install -g flowzap-mcpMCP 文档

相关模板