Control coverage, stated honestly

Agent tool calls over MCP (stdio)

With the gateway in the path and enforce mode on, a denied tool call is answered with an error and never reaches the tool server.

Honest limit: Opt-in. The gateway ships in observe mode, which forwards and records everything until you turn enforcement on.

Agent tool calls over MCP (HTTP)

With the gateway in the path and enforce mode on, a denied remote tool call is answered by the gateway and never forwarded upstream.

Honest limit: Opt-in, same observe-first default. Streaming (SSE) results are not parsed in the current version.

A tool that changes its own description after you approved it

Tool descriptions are pinned on first sight. A changed description trips a circuit breaker that refuses the call until a human re-approves the tool, and an unreadable pin store fails closed.

Honest limit: Opt-in in the sense that the gateway must be in the path at all. Once it is, the breaker is always on and does not depend on enforce mode.

Tool calls your policy marks as needing a human

The call is denied with a single-use approval token bound to exactly that agent, action, resource, and argument set. A human approves, the agent retries, and the token cannot bless anything else.

Honest limit: Opt-in, enforce mode only. The in-flight call fails and is retried after approval rather than being held open.

An agent edit that introduces a critical or high finding

The extension reviews agent-shaped edits as they land and interrupts you with the finding and a one-step revert.

Honest limit: This happens after the write reaches disk. Editors do not let one extension veto another program before it writes, so this is a fast interrupt with an honest revert, not a block.

Which MCP servers and tools your agents can reach

The review inventories configured MCP servers across editors and flags credentials in server arguments and servers you did not expect.

Honest limit: A configuration review, run on demand. It reads what is configured, not live traffic.

Whether agents in this environment can reach a shell

The review reports the shells, container tools, and cluster tools present in the environment an agent would inherit.

Honest limit: Presence, not usage. It tells you the blast radius exists, not that a command ran.

What your agents could push, and with whose credentials

The review reads repository configuration and reports push access and credential exposure.

Honest limit: Configuration, reviewed on demand.

Commands your agents run without being asked (hooks)

The review lists agent hooks, the highest-authority configuration in the environment, so you can read every command an agent will run unprompted.

Honest limit: Detection at rest. Hook execution itself is not intercepted (see below).

Suspicious dependencies an agent suggested

Dependency names are checked against known suspicious-package patterns and lookalikes.

Honest limit: A lookup on names, not a sandbox.

What your written authorization policy would decide

The review evaluates an authorization policy against the findings and shows which rules would allow, deny, or ask for approval, and exports that policy for other tools to enforce.

Honest limit: Advisory in the review tier. Enforcement of these rules happens only where a row above says prevents.

What was decided, in an order nobody can quietly rewrite

Decisions and gateway activity land in a hash-chained local ledger with inclusion proofs and optional per-entry signatures. Gateway records carry hashes of payloads, not your code.

Honest limit: Tamper-evident under the local trust model. An attacker with your OS user can still alter local state. The honest fix for that is an external anchor, which is on the roadmap and is not claimed here.

Shell commands at the moment they run

No interception of shell or terminal execution exists today.

Git operations at the moment they run

No commit or push hook is installed by DeepSweep today.

Secret reads at runtime

Nothing brokers or intercepts a secret read today. The review detects exposure at rest only.

Agent network traffic

No allowlist, proxy, or DNS control over what an agent sends off the machine exists today.

File writes before they reach disk

General pre-write veto does not exist today. The extension interrupts after the write (see above).

Agents running on a vendor cloud

A local layer does not see an agent acting from vendor infrastructure. If your agents run in a vendor cloud, this product does not referee them today.

Database writes and deploy triggers at the moment they run

Advisory policy rules exist for these, and nothing enforces them at execution time today.