7 views
-/https://github.com/berriai/litellm/issues/29593
GitHub · issue

#29593 [Bug]: Generic Guardrail API should extract and redact tool result content in Anthropic messages

  • State: open
  • Author: @yuval-fiddler
  • Labels: bug, llm translation

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

#### What happened?

When using the Generic Guardrail API with Anthropic-format messages, **tool result content is silently skipped** during text extraction. This means file contents, API responses, and other data returned by tools (e.g., MCP file reads, API calls) bypass guardrail scanning entirely.

#### Root Cause

In `litellm/llms/anthropic/chat/guardrail_translation/handler.py`, the `_extract_input_text_and_images()` method extracts text from list content blocks by looking for `content_item.get("text")`:

```python elif content is not None and isinstance(content, list): for content_idx, content_item in enumerate(content): text_str = content_item.get("text", None) # ← only looks for "text" key ``` However, Anthropic tool result blocks use "content" instead of "text": ``` { "role": "user", "content": [ { "type": "tool_result", "tool_use_id": "toolu_abc123", "content": "export OPENAI_API_KEY=sk-abc123..." } ] } ``` Since content_item.get("text") returns None for tool result blocks…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (3 events)
#0 of 0 · 31d19h3m20s ago — entered · #import:https:::github.com:berriai:litellm post #1909
The left issue is harder because it requires changes to guardrail extraction and redaction behavior across structured message content, with security-sensitive edge cases and regression tests. The right issue is primarily a contained metadata and pricing-maintenance update, requiring verification but limited implementation complexity.
The left task likely requires tracing provider-specific streaming termination through multiple translation layers and validating compatibility with a client protocol, creating greater debugging and regression risk. The right task appears more localized to a single parsing path with focused tests and limited behavioral scope.
#0 of 0 · 31d18h48m52s ago — current · #import:https:::github.com:berriai:litellm post #2157
The right issue is harder because it requires modifying runtime guardrail translation behavior, handling multiple content shapes safely, and adding regression coverage for a security-sensitive path. The left issue is primarily a metadata consistency and completeness update, with comparatively limited code risk.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search