Function buildMessage

packages/ai-code-mode/src/validate-bindings.ts:139–147

(toolName: string, paramPath: Array<string>)

}

function buildMessage(toolName: string, paramPath: Array<string>): string {
  return (
    `[TanStack AI Code Mode] Tool "${toolName}" has parameter "${paramPath.join('.')}" ` +
    `that looks like a secret. Code Mode executes LLM-generated code — any ` +
    `value passed through this parameter is accessible to generated code and ` +
    `could be exfiltrated. Keep secrets in your server-side tool implementation ` +
    `instead of passing them as tool parameters.`
  )
}

/**
 * Scan tool input schemas for parameter names that look like secrets.