CodeSmith's character-level sanitization is deployed at two chokepoints: at the ingress, MCP tool call arguments are cleaned in their entirety before forwarding (mcp.rs:3150-3158), and at the egress, all tool output passes through once before entering the model context and conversation record (engine/context.rs:301-312).