A tool call is a privilege request.
Enforce tool allowlists, path boundaries, destructive approvals, secret checks, and SSRF controls. Edit the call or the policy and rerun: the same engine the CLI uses, ported to JavaScript and pinned to it by a parity test. Nothing is sent anywhere.
Analysis input
Checkable result
Loading demo…