Content Middleware

Content middleware is what you configure to inspect what an agent sends and receives. This page gets a first chain and a first raw hook running; the guides below go deeper. For what content mediation is and where it sits in the request path, read Content Mediation first.

Guide	Purpose
The Built-in Chain	Redact, restrict models, cap tokens and meter LLM traffic
Writing a Content Checker	Bring your own DLP or classifier into the chain
Raw Content Hooks	Govern MCP, A2A, persistence, telemetry and everything else the chain does not reach

A first chain

content_middleware:
  chain:
    - name: pii-redact
      type: regex_dlp
      on_error: deny
      options:
        detect:
          - name: ssn
            pattern: '[0-9]{3}-[0-9]{2}-[0-9]{4}'

That redacts anything shaped like an SSN from every LLM request an agent makes, whichever provider it calls. On any other HTTP request with a text or JSON body there is nowhere to redact safely, so a match refuses the call instead (see Why the chain does not edit these bodies); to rewrite those requests, use a raw_request hook. regex_dlp ships with no patterns; the chain guide says why.

The chain covers HTTP traffic only; everything else takes a raw hook.

A first raw hook

content_middleware:
  raw_request:
    url: http://127.0.0.1:9900/request
    on_error: deny
    operations:
      - agentvisor:mcp:*            # every MCP operation…
    exclude_operations:
      - agentvisor:mcp:tool:list    # …except listing tools

That hands every outbound MCP request — tool calls and their arguments, resource reads — to your service before it is made, apart from tool listings, and refuses the call if your service says deny — or cannot be reached. operations selects what the hook runs on and exclude_operations trims that selection; see Scoping a hook for how the two behave as new operations are added. Run the service on loopback: off HTTP it is handed real data, and a raw hook cannot yet authenticate itself or verify a private certificate. See Where to run your hook.

Check what it governs

Before serving a single request, AgentVisor logs every chain entry and hook and the operations each one actually governs:

content middleware: chain active   entries=1 on_unknown_format=whole_body
content middleware: entry scope    name=pii-redact type=regex_dlp lane=sync
                                   on_error=deny phases=request
                                   operations=agentvisor:http:request resources=all

Read it once after configuring and again after each upgrade. A configuration that cannot work — a pattern matching no hooked operation, a scope on the wrong phase, a chain entry on a path the chain never runs — stops AgentVisor from starting, so a misconfigured check is never silently inactive.

Record the decisions

Every verdict is an OTLP log record. Send them somewhere:

telemetry:
  audit:
    enabled: true
    protocol: http
    endpoint: https://collector:4318

A record names who acted and on what, so send records over TLS. Use a plaintext endpoint (http://, or tls.mode: disable) only for a collector on the same host.

Printed by the audit console in the content middleware example, a record looks like this. The attributes the record itself carries are listed in the reference:

agentvisor:http:request  modify  by pii-redact
  resource  mrn:agentvisor:http:api.anthropic.com/v1/messages
  inspected 2 span(s)
  finding   ssn at /messages/0/content (confidence 1)
  evaluated pii-redact
  principal=… thread_id=… run_id=…

AgentVisor never copies message text or tool-argument values into a record; what it does record from the agent, and from your own checkers, is listed under Every decision is recorded. Every field is listed in the reference.

At startup AgentVisor logs where the records go:

content middleware: audit stream active   endpoint=https://collector:4318 protocol=http

If content middleware is configured and telemetry.audit is not enabled, AgentVisor logs a warning instead, because none of the decisions it makes will be recorded.