you might be able to add one other simple check as a hook to do some simple checks on tools to see if there's any credentials, and deby the tool call. wont cat

you might be able to add one other simple check as a hook to do some simple checks on tools to see if there's any credentials, and deby the tool call. wont catch the myriad of possible obfuscation, but its simple