Creating Tools for File System Operations

Equipping Language Models with the ability to interact with a file system opens up a wide range of applications, from saving generated code and research notes to reading configuration files or datasets. Here is how to construct tools that allow LLMs to perform file operations securely. The primary challenge and focus is safety: unrestricted file access is a major security risk. Therefore, careful sandboxing and path handling will be emphasized.

Core File System Operations as Tools

For an LLM agent to effectively manage files, it typically needs a few core capabilities. These can be translated into distinct tools:

• Reading Files: This allows the agent to load the content of a file into its context, perhaps to analyze data, understand existing code, or retrieve information.
• Writing Files: This enables the agent to save its outputs, create new documents, or modify existing ones. This is fundamental for tasks where the agent produces an artifact.
• Listing Directory Contents: To navigate and understand its environment, an agent needs to see what files and folders are present in a given directory.
• Creating Directories: For better organization, an agent might need to create new folders to store its generated files.
• Deleting Files/Directories: This is a powerful and potentially destructive operation. If provided, it must be handled with extreme caution and often with additional confirmation steps or restrictions.

It's generally advisable to implement these as separate, fine-grained tools (e.g., a read_file tool, a write_file tool) rather than a single, complex tool with sub-commands. This simplifies the tool's description for the LLM, reduces ambiguity, and allows for more targeted security policies per operation.

Designing Tool Inputs and Outputs

Each file operation tool requires clearly defined inputs (parameters) and outputs (results). Let's consider some examples:

read_file Tool:

• Input Parameters:
  • file_path (string): The path to the file, which must be relative to a designated sandbox directory.
  • encoding (string, optional): The character encoding of the file (e.g., 'utf-8'). Defaults to 'utf-8'.
• Output Structure:
  • A JSON object containing either content (string) with the file's data or error (string) detailing any issues.

write_file Tool:

• Input Parameters:
  • file_path (string): The relative path, within the sandbox, where the file should be created or overwritten.
  • content (string): The actual data or text to be written to the file.
  • mode (string, optional): Specifies the write mode, typically 'w' for overwrite or 'a' for append. Defaults to 'w'.
• Output Structure:
  • A JSON object with a status (string) message on success (e.g., "File 'example.txt' written successfully.") or an error (string) on failure.

list_directory Tool:

• Input Parameters:
  • directory_path (string, optional): The relative path to the directory within the sandbox. If omitted, it could default to the root of the sandbox.
• Output Structure:
  • A JSON object containing items (list of strings, where each string is a file or directory name) or an error (string).

The Imperative of Security: Sandboxing and Path Validation

The most significant aspect of building file system tools is ensuring they operate securely. An LLM, by its nature, might generate or be prompted with file paths that could, if unchecked, lead to unauthorized access or modification of sensitive system files.

Sandboxing

Sandboxing is a technique where the LLM agent's file operations are strictly confined to a specific directory or a set of directories (the "sandbox"). The agent should have no awareness of or access to any part of the file system outside this pre-defined area. All file paths specified by the LLM must be interpreted as relative to the root of this sandbox.

This diagram shows the file system tool mediating access. Requests from the LLM are validated; operations within the designated sandbox are allowed, while attempts to reach sensitive areas outside the sandbox are blocked.

Path Validation and Normalization

Even within a sandbox, paths provided by the LLM (or derived from external input) need rigorous validation:

1. Establish Sandbox Root: Your tool must have a clearly defined absolute path to the root of its sandbox (e.g., /srv/app/agent_files/user123/). This path should not be alterable by the LLM.
2. Combine and Normalize: The relative path from the LLM (e.g., reports/report.txt) is joined with the sandbox root. The resulting path should then be normalized to resolve constructs like . (current directory) and .. (parent directory). Python's os.path.join() and os.path.normpath() are useful here.
3. Resolve to Absolute Path: Convert the combined, normalized path into a canonical, absolute file system path. Python's pathlib.Path.resolve() is excellent for this as it also handles symbolic links (though you might want to disallow operations on symlinks that point outside the sandbox).
4. Verify Containment: This is the most important check. The final, resolved absolute path must be within the sandbox root directory. If resolved_path.is_relative_to(sandbox_root_path) (Python 3.9+) is false, or an equivalent check fails, the operation must be denied. This prevents path traversal attacks (e.g., ../../../../../etc/passwd).

Implementing Secure File Tools in Python

Here's a Python implementation outline for a FileSystemTools class, focusing on the security aspects:

import os
import pathlib

# This should be securely configured, perhaps per-agent or per-session.
# For example, from environment variables or a secure configuration service.
# Ensure this directory exists and has appropriate permissions.
SANDBOX_ROOT_DIR = pathlib.Path(os.getenv("AGENT_SANDBOX_ROOT", "./default_agent_sandbox")).resolve()
SANDBOX_ROOT_DIR.mkdir(parents=True, exist_ok=True) # Create if it doesn't exist

def _get_sandboxed_path(relative_path_str: str) -> pathlib.Path | None:
    """
    Safely resolves a relative path string to an absolute path within the sandbox.
    Returns None if the path is invalid or outside the sandbox.
    """
    if not relative_path_str or not isinstance(relative_path_str, str):
        # print("Security: Invalid path input type or empty path.")
        return None

    # Disallow absolute paths or attempts to use backslashes/slashes at the start
    # that might bypass naive joining.
    if os.path.isabs(relative_path_str) or relative_path_str.startswith(('/', '\\')):
        # print(f"Security: Absolute path attempt rejected: {relative_path_str}")
        return None

    # Create the full path by joining the sandbox root with the relative path.
    # This is still potentially unsafe until resolved and checked.
    candidate_path = SANDBOX_ROOT_DIR / relative_path_str

    try:
        # Resolve the path to its canonical absolute form.
        # This processes '..' and symbolic links.
        # strict=False allows resolving paths to non-existent files for 'write' operations.
        # For 'read' or 'list', you might want strict=True if the path must exist.
        resolved_path = candidate_path.resolve(strict=False)
    except FileNotFoundError:
        # If strict=True and path doesn't exist (e.g., for a read operation)
        # print(f"Security/Info: Path does not exist for resolution (strict): {candidate_path}")
        return None # Or handle as "file not found" specifically
    except Exception as e:
        # Other resolution errors (e.g., symlink loop on some OS, invalid chars)
        # print(f"Security: Path resolution error for '{candidate_path}': {e}")
        return None

    # The critical security check: Is the resolved path still within the sandbox?
    # For Python 3.9+
    if hasattr(resolved_path, 'is_relative_to'):
        if resolved_path.is_relative_to(SANDBOX_ROOT_DIR):
            return resolved_path
    else: # Fallback for older Python versions
        # Ensure resolved_path starts with SANDBOX_ROOT_DIR as strings,
        # being careful about trailing slashes for accurate comparison.
        # Or check if SANDBOX_ROOT_DIR is one of the parents of resolved_path.
        if SANDBOX_ROOT_DIR == resolved_path or SANDBOX_ROOT_DIR in resolved_path.parents:
             return resolved_path

    # print(f"Security: Path traversal attempt. Resolved path '{resolved_path}' is outside sandbox '{SANDBOX_ROOT_DIR}'.")
    return None

class FileSystemTools:
    MAX_FILE_SIZE = 10 * 1024 * 1024  # Example: 10MB limit

    def read_file(self, file_path: str, encoding: str = 'utf-8') -> dict:
        """Reads a file from the agent's sandbox."""
        resolved_path = _get_sandboxed_path(file_path)
        if not resolved_path:
            return {"error": f"Access denied or invalid path: {file_path}"}

        if not resolved_path.is_file():
            return {"error": f"File not found or not a regular file: {file_path}"}

        try:
            # Check file size before reading to prevent memory issues with large files
            if resolved_path.stat().st_size > self.MAX_FILE_SIZE:
                return {"error": f"File exceeds maximum allowed size: {file_path}"}
            content = resolved_path.read_text(encoding=encoding)
            return {"content": content}
        except Exception as e:
            return {"error": f"Could not read file '{file_path}': {str(e)}"}

    def write_file(self, file_path: str, content: str, mode: str = 'w') -> dict:
        """Writes content to a file in the agent's sandbox."""
        resolved_path = _get_sandboxed_path(file_path)
        if not resolved_path:
            return {"error": f"Access denied or invalid path for writing: {file_path}"}

        if mode not in ['w', 'a']:
            return {"error": "Invalid write mode. Use 'w' (overwrite) or 'a' (append)."}

        # Check content size before writing
        if len(content.encode(errors='ignore')) > self.MAX_FILE_SIZE:
             return {"error": "Content exceeds maximum allowed file size."}

        try:
            # Ensure parent directories exist
            resolved_path.parent.mkdir(parents=True, exist_ok=True)

            with open(resolved_path, mode, encoding='utf-8') as f:
                f.write(content)
            return {"status": f"File '{file_path}' {'written' if mode == 'w' else 'appended'} successfully."}
        except Exception as e:
            return {"error": f"Could not write to file '{file_path}': {str(e)}"}

    def list_directory(self, directory_path: str = ".") -> dict:
        """Lists contents of a directory in the agent's sandbox."""
        # Using "." as default means list the root of the sandbox
        resolved_path = _get_sandboxed_path(directory_path)
        if not resolved_path:
            return {"error": f"Access denied or invalid directory path: {directory_path}"}

        if not resolved_path.is_dir():
            return {"error": f"Path is not a directory or does not exist: {directory_path}"}

        try:
            items = [item.name for item in resolved_path.iterdir()]
            return {"items": items}
        except Exception as e:
            return {"error": f"Could not list directory '{directory_path}': {str(e)}"}

In the _get_sandboxed_path function, candidate_path.resolve(strict=False) is generally appropriate because for a write_file operation, the file itself might not exist yet. The strict=False argument allows the resolution of the path up to the last non-existent component. The subsequent check using is_relative_to (or the parent check for older Python) is the ultimate gatekeeper. Adding print statements for security events (commented out in the example) is good for development and debugging but should be replaced with proper logging in production.

Agent Interaction and Error Handling

The LLM agent will invoke these tools by specifying the tool name and its parameters. For instance, to read a file: LLM Request: {"tool_name": "read_file", "parameters": {"file_path": "project_notes/alpha_phase.md"}}

The tool's response should be structured and informative:

• Success: {"content": "Contents of alpha_phase.md..."}
• File Not Found: {"error": "File not found or not a regular file: project_notes/alpha_phase.md"}
• Security Violation / Path Traversal: {"error": "Access denied or invalid path: ../../sensitive_config.ini"}

Clear, distinct error messages help the LLM (and developers) understand the outcome. Security-related errors should explicitly state that access was denied rather than, for example, just saying "file not found," as this can guide the LLM's subsequent actions or prompt for clarification.

Further Security and Operational Enhancements

• Resource Limits: Implement limits on file sizes (as shown in the example MAX_FILE_SIZE), the number of files an agent can create, and potentially the total disk space allocated to an agent's sandbox.
• Permissions Granularity: Instead of simple sandboxing, you might need role-based access control. For example, some agents might only have read access, while others can write or delete. This typically requires integration with an identity and authorization system.
• Auditing: Implement comprehensive logging for all file system tool invocations. Logs should include the agent identifier, timestamp, requested operation, input parameters (especially the path), the resolved path, and the outcome. This is invaluable for security analysis and debugging.
• Deny Lists for Filenames/Extensions: You might want to prevent agents from creating or interacting with certain types of files (e.g., executables) or files with specific names, even within the sandbox.

By carefully designing file system tools with security as the primary concern, you can significantly extend an LLM agent's ability to perform useful tasks that involve data persistence and interaction with a local environment. Always test these tools rigorously, especially their security enforcement mechanisms under various edge cases.