The tool_call hook¶

A config's tool_call handler runs just before a tool executes, and can rewrite the call's arguments or reject it outright. It is handed the Invocation: its name and input table, which the handler can reassign.

Reducing token usage with rtk is a full worked example of rewriting arguments this way, routing every bash command through the rtk CLI.

A handler that raises an error rejects the call outright: the tool does not run and the model is told it failed. This lets you veto specific calls, for example refusing to run a tool outside the project directory:

agent.on('tool_call', function(invocation)
  if invocation.name == 'bash' then
    local command = invocation.input.command or ''
    if command:find('rm%s+-rf%s+/') then
      error('refusing to run a recursive delete of an absolute path')
    end
  end
end)

See Trust and security for what this hook can and cannot guarantee.