Maybe. I'm just spitballing but as I've been thinking about this, maybe just like a set of shell scripts.

The idea could be that the agent runs as a unix user. That user has execute access to these scripts but not read or write access.

So the agent can only do what those scripts allow, the scripts present an API. You could let agents call the scripts with -h to get instructions, and just put some text into context saying like "to access helper scripts call ./showHelp".