Intercept by PromptPHP banner
When Laravel News covered Intercept (opens in a new tab), it was at v0.1.4 and it shipped two security middleware Povillas Korop also made a video demo at the time (opens in a new tab). That’s still true, but a lot has changed underneath and if you installed it that week you’re several releases behind on things you’d want.
Here’s the whole run with newest first.
v0.3.0 - Tool Approval Guard
Tool calls an agent proposes while pausing for human approval are now scanned. v10.0.0 of the Laravel AI SDK has introduced Human-in-the-loop, allowing a person to approve, edit, or reject tool calls (laravel/ai#773 (opens in a new tab)). Intercept now ships a new package called ToolApprovalGuard which inspects the tool calls an agent proposes while pausing for human approval, before those calls are ever surfaced for review. This is huge because when an agent is manipulated by content Intercept never saw, the damage almost always surfaces as a tool call.
v0.2.0 - Approval decisions, human in the loop
Approval decisions are now scanned. When a paused agent run resumes with Decisions, the prompt is empty and the only new content is what a human supplied while resolving pending tool calls. Edited tool arguments and rejection results were reaching the provider unscanned. Both PromptInjectionGuard and PIIRedactor now inspect them by default, controlled with scan_approval_decisions, a new config element.
Also, resumed prompts are immutable which implies that a paused turn has to replay verbatim against the provider that recorded it. For this reason we’ve had to degrade the redact, mask, sanitize, and warn actions to simply log when they are detected on resumed prompts. The block action still stops the run.
v0.1.9 - A pattern we got wrong
We fixed an injection pattern that should never have been broken. Our pattern matching failed to match a number of canonical injection strings as the ignoreand disregardpatterns required the noun to follow the qualifier immediately. The forgetpattern however had the correct structure all along. They’re now aligned.
v0.1.8 - PHP 8.3 support
We dowgraded the supported PHP version across the whole middleware collection from PHP 8.4 to PHP 8.3 which is supported by the Laravel AI SDK.
v0.1.7 - URL detection, and every version of laravel/ai
URLs are now a detectable PII entity. They can be redacted, masked, logged, or blocked like any other entity type. Useful more often than you’d expect: internal admin links, signed URLs, and anything with a token in a query string were all previously invisible to the redactor.
Support for all versions of laravel/ai. The version constraint was pinned tighter than it needed to be.
v0.1.6 - MAC address detection
MAC addresses joined the entity list, with the same redact / mask / log / block handling as everything else.
v0.1.5 - Hardened patterns and contribution guidelines
Built-in prompt injection patterns were tightened. Contribution guidelines landed so the collection can take outside PRs consistently, and the roadmap was updated.
Upgrading from v0.1.4
composer update promptphp/interceptNo config changes required. Every middleware still works with no published config at all, and constructor values still beat config which still beats internal defaults.
To install Intercept, run
composer require promptphp/interceptintercept.promptphp.com (opens in a new tab) | Changelog (opens in a new tab)| GitHub (opens in a new tab)
Requires PHP 8.3+ and laravel/ai. MIT licensed.
If Intercept is useful to you, a star on GitHub (opens in a new tab) genuinely helps other people find it.