Would a community security logic extension (ATR-backed pre/post webhook) be welcome?

[eeee2345]

Hi — I built a working reference implementation of a security logic extension using the http/1.0 contract (/pre, /post, /access, /health) and wanted to check interest before opening a PR.

What it does

It runs Agent Threat Rules (ATR) — an open, MIT-licensed detection ruleset for AI-agent threats (prompt injection, tool poisoning, credential exfiltration, etc.) — as a pre/post webhook:

• /pre scans the tool name + inputs and returns CHECK_FAILED (block) with the matched ATR rule ids in error_message when a prompt-injection or tool-poisoning pattern matches, otherwise OK.
• /post scans the tool output and, on a match, returns OK with an override.output that redacts the result so a poisoned tool result never reaches the model.
• Detection is fully offline and deterministic (no model call, no network) via the published agent-threat-rules package.

Demo output (benign / prompt-injection / tool-poisoning cases):

benign allow OK —
prompt-injection deny CHECK_FAILED ATR-2026-00120, ATR-2026-00114
tool-poisoning deny CHECK_FAILED ATR-2026-00113, ATR-2026-00161, ...

It's built and demo-tested locally (Node/TypeScript, matching the http/1.0 contract from ArcadeAI/schemas). Before opening a PR I wanted to ask:

1. Is a community-contributed security example something this repo takes, or is it curated to first-party/partner examples only?
2. The existing examples here look Go-based — would a Node/TypeScript example fit alongside, or would you prefer it ported?

Happy to open a PR against this repo (or a fork under the Agent-Threat-Rule org, cross-linked) once I know the shape you'd want.