# Action Firewall - Block Destructive AI Agent Actions (`apricot_blackberry/agent-action-firewall`) Actor

A safety gate in front of every agent action. Classifies a proposed shell, SQL, API, payment, or delete as allow / require-approval / block against a destructive-action taxonomy and your policy, before it runs. Catches rm-rf, fork bombs, DROP TABLE, and force-push.

- **URL**: https://apify.com/apricot\_blackberry/agent-action-firewall.md
- **Developed by:** [Creator Fusion](https://apify.com/apricot_blackberry) (community)
- **Categories:** AI, Developer tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Agent Action Firewall

**Creator Fusion Labs — Agent Protection Suite**

A pre-execution safety gate for AI agents. Your agent submits a **proposed action** — a shell command, SQL statement, HTTP request, file operation, message/email, or payment — and the firewall classifies it **before it runs**, returning a verdict (`allow`, `require-approval`, `block`), a 0-100 risk score, the exact rules that matched, and a recommendation. Wire it in front of any tool-execution step so a destructive or unauthorized action is caught instead of executed.

This is a stateless classifier: it reads only the action you pass. No network calls, no data collection, no credentials.

### What it catches

- **Destructive / irreversible verbs** — `rm -rf`, `DROP`/`TRUNCATE`, `DELETE`/`UPDATE` without a `WHERE`, `git push --force`, disk format/`dd`/`shred`, fund transfers/payments, publish/deploy-to-prod.
- **Remote code execution** — `curl … | sh` style download-and-run.
- **Data egress** — outbound `POST`/`PUT`/upload carrying credential- or PII-looking data.
- **Blast radius** — root/`/`/wildcard scope, recursive flags, and production targets escalate the score.
- **Policy** — optional `allow`/`deny` lists and a `maxRisk` ceiling.

### Input

| Field | Type | Notes |
|-------|------|-------|
| `action` | string (**required**) | A command string (e.g. `"rm -rf /tmp/cache"`, `"DROP TABLE users;"`) **or** a JSON object (as a string, or a real object via API/MCP) with `type`, `command`, `target`, `args`. |
| `policy` | object | `{ allow: [...], deny: [...], maxRisk: 0-100 }`. `deny` forces block; `allow` permits non-critical actions; `maxRisk` caps silent allows. |
| `environment` | string | `prod` | `staging` | `dev`. `prod` escalates flagged actions. |

### Output (one row per run)

```json
{
  "verdict": "block",
  "riskScore": 100,
  "category": "filesystem",
  "matchedRules": [
    { "rule": "fs-recursive-force-delete", "severity": "critical", "detail": "Recursive force delete (rm -rf …) — irreversible bulk file removal." }
  ],
  "reasons": ["[critical] Recursive force delete …", "Targets a root / whole-filesystem / global scope."],
  "recommendation": "Do NOT execute. Destructive/irreversible or explicitly denied; escalate to a human."
}
```

`verdict` thresholds (before policy overrides): riskScore ≥ 60 → `block`, ≥ 25 → `require-approval`, else `allow`.

### Use it from an agent

**MCP** — add the actor to your Apify MCP server and call it as a tool, passing `{ "action": "<command>" }`.

**curl**

```bash
curl -X POST "https://api.apify.com/v2/acts/apricot_blackberry~agent-action-firewall/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{ "action": "rm -rf /", "environment": "prod" }'
```

**JavaScript**

```js
import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const { defaultDatasetId } = await client.actor('apricot_blackberry/agent-action-firewall')
  .call({ action: 'DROP TABLE users;' });
const { items } = await client.dataset(defaultDatasetId).listItems();
if (items[0].verdict !== 'allow') throw new Error(`Blocked: ${items[0].recommendation}`);
```

**Python**

```python
from apify_client import ApifyClient
client = ApifyClient(token)
run = client.actor("apricot_blackberry/agent-action-firewall").call(
    run_input={"action": "ls -la ./logs"})
row = next(iter(client.dataset(run["defaultDatasetId"]).iterate_items()))
print(row["verdict"], row["riskScore"])
```

### Pricing

Pay-per-event: an actor-start fee plus one `evaluate` event per successful classification. Failed/invalid-input runs emit an auditable error row and are **not** charged the `evaluate` event.

### Limitations

Heuristic, not a sandbox — it scores the *text* of a proposed action against a curated rule set. Treat `require-approval`/`block` as strong signals, not a formal proof of safety, and keep a human in the loop for high-stakes actions. Obfuscated commands (base64, heavy indirection) may score lower than their true intent.

# Actor input Schema

## `action` (type: `string`):

The action to classify BEFORE it runs. Pass EITHER a plain command string (e.g. "rm -rf /tmp/cache" or "DROP TABLE users;") OR a JSON object (as a string) with any of: type (shell|sql|http-request|filesystem|send-message|payment|delete), command, target, args (array) — e.g. {"type":"shell","command":"rm -rf /var/data","target":"/var/data"}. Both forms are accepted; the object form gives sharper classification. Callers using the run API/MCP may also pass a real JSON object here.

## `policy` (type: `object`):

Optional caller policy. allow: array of substrings that force an 'allow' verdict for non-critical actions. deny: array of substrings that force a 'block'. maxRisk: number 0-100; an action scoring above it can only be permitted with approval, never silently allowed.

## `environment` (type: `string`):

Where the action would run. 'prod' escalates the risk of any flagged action (production blast radius). Used for scoring only.

## Actor input object example

```json
{
  "action": "rm -rf /var/data",
  "policy": {
    "allow": [],
    "deny": [],
    "maxRisk": 60
  },
  "environment": "prod"
}
```

# Actor output Schema

## `verdicts` (type: `string`):

The verdict row(s) in the default dataset — verdict, riskScore, category, matchedRules, reasons, recommendation.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "action": "rm -rf /var/data",
    "policy": {
        "allow": [],
        "deny": [],
        "maxRisk": 60
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("apricot_blackberry/agent-action-firewall").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "action": "rm -rf /var/data",
    "policy": {
        "allow": [],
        "deny": [],
        "maxRisk": 60,
    },
}

# Run the Actor and wait for it to finish
run = client.actor("apricot_blackberry/agent-action-firewall").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "action": "rm -rf /var/data",
  "policy": {
    "allow": [],
    "deny": [],
    "maxRisk": 60
  }
}' |
apify call apricot_blackberry/agent-action-firewall --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,apricot_blackberry/agent-action-firewall"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/jDoV7dUHuaFIQNPcb/builds/hZXfHf8lofJ0fxb1c/openapi.json