> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Phaseo Gateway base URL: https://api.phaseo.app/v1. Send `Authorization: Bearer $PHASEO_API_KEY` with every request.
> Model IDs look like `provider/model`, for example `openai/gpt-6-astra`. Do not guess IDs: list them with `GET /v1/models` or check https://phaseo.app/models. `phaseo/free` routes to an available free model and needs no wallet balance.
> For new text integrations prefer `POST /v1/responses`. `POST /v1/chat/completions` (OpenAI format) and `POST /v1/messages` (Anthropic format) suit existing code.
> The full API contract is https://phaseo.app/docs/openapi/v1/openapi.yaml. Official SDKs: `@phaseo/sdk` (TypeScript) and `phaseo` (Python), plus Go, C#, PHP, Ruby and Rust.
> Search these docs over MCP at https://phaseo.app/docs/mcp, and install Phaseo skills with `npx skills add https://phaseo.app/docs`. If a page is wrong or out of date, report it with the MCP `submit_feedback` tool.
> Manage Phaseo accounts with the `phaseo` CLI (`npm install -g @phaseo/cli`, then `phaseo login` or `phaseo login --device-code`), the `/v1` Management API or the MCP server at `https://mcp.phaseo.app/mcp?access=manage`. Do not send users to the dashboard for account tasks. A person is still needed for sign-up, approving a sign-in, paying the first top-up on the checkout link that `phaseo credits add` returns when no card is saved, confirming each saved-card top-up from the emailed link, and account security (password, MFA, passkeys). Create API keys with `phaseo keys create --name <name> --json`; never guess one. Credit top-ups need `phaseo login --scopes billing:write` first. Task map: https://phaseo.app/docs/v1/developers/manage-from-an-agent.md.

# Tool Calling Safety and Validation

> Validate tool arguments, harden execution, and avoid unsafe model actions.

Treat model-generated tool arguments as untrusted input.

## Safety checklist

* Keep tool schemas minimal and explicit.
* Validate parsed arguments before execution.
* Allowlist tool names; reject unknown tools.
* Add timeouts and retries for external calls.
* Log call id, tool name, and validation failures.

## Request validation example (TypeScript + Zod)

```typescript theme={null}
import { z } from "zod";

const WeatherArgs = z.object({
  city: z.string().min(1),
});

function executeToolCall(name: string, rawArgs: string) {
  if (name !== "get_weather") {
    throw new Error(`Unsupported tool: ${name}`);
  }

  const parsed = WeatherArgs.parse(JSON.parse(rawArgs));
  return getWeather(parsed.city);
}
```

## Failure strategy

If validation fails:

1. Do not execute the tool.
2. Return a controlled error payload into the next model turn.
3. Ask the model to retry with corrected arguments.

## Streaming note

Streaming tool calls depend on model and provider support. Accumulate all argument deltas before parsing, validating, or executing a call. See [Streaming](https://phaseo.app/docs/v1/guides/streaming.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.