> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool Defense

> Override Defender per toolset in the Agent SDK.

Defender scans tool call responses for prompt injection before they reach your LLM. It runs **server-side on every RPC call**, so it protects any agent — MCP, the Agent SDK, or a direct API call — regardless of language. Project-wide settings live in the dashboard — see [Defender](/secure/defender) for the concept and configuration. This page covers per-toolset overrides in the SDK.

## Per-toolset SDK configuration

<Warning>
  Per-toolset SDK configuration is currently available only in the **TypeScript** SDK (`@stackone/ai`). Python agents still get Defender via the [dashboard setting](/secure/defender#configure-from-the-dashboard). It runs server-side on every call.
</Warning>

Override the dashboard setting for a specific toolset with the `defender` option on `StackOneToolSet`. It accepts four shapes:

| `defender` value | Behavior |
| - | - |
| omitted *(default)* | Project dashboard setting controls |
| `{ useProjectSettings: true }` | Same as omitting: explicit and self-documenting |
| `{ enabled, blockHighRisk, useTier1Classification, useTier2Classification }` | SDK-level config overrides the dashboard |
| `null` | Forcibly disables Defender for this toolset |

```typescript theme={null}
import { DEFAULT_DEFENDER_CONFIG, StackOneToolSet } from '@stackone/ai';

// Scan with safe defaults, but block on HIGH or CRITICAL risk
const toolset = new StackOneToolSet({
  defender: { ...DEFAULT_DEFENDER_CONFIG, blockHighRisk: true },
});

toolset.defenderMode; // 'project' | 'disabled' | 'explicit'
```

When Defender runs, the RPC response includes a `defenderMetadata` sibling next to `data` with the risk level, sanitized fields, and detections. See the [full TypeScript reference](/features/tool-defense) for every config field, the resolved-mode getter, and the override warnings.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.