[{"data":1,"prerenderedAt":1314},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Ftools":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":64,"body":80,"description":1307,"extension":1308,"group":19,"meta":1309,"navTitle":64,"navigation":1310,"order":65,"path":63,"seo":1311,"stem":1312,"__hash__":1313},"docs\u002Fdocs\u002Ftools.md",{"type":81,"value":82,"toc":1292},"minimark",[83,87,100,116,121,124,280,288,292,299,369,372,398,403,408,415,429,497,500,551,581,585,684,690,702,706,827,843,845,850,857,861,867,891,916,922,927,931,937,987,993,1007,1030,1034,1073,1094,1097,1100,1162,1168,1172,1235,1266,1274,1278,1288],[84,85,64],"h1",{"id":86},"tool-reference",[88,89,90,91,95,96,99],"p",{},"The tools are the deterministic half of locac. The model decides ",[92,93,94],"em",{},"what"," to look at and ",[92,97,98],{},"whether"," a\npath is exploitable; the tools do the mechanical work of parsing, indexing, tracing and executing, and\nthey are the only things that can produce evidence.",[88,101,102,103,107,108,111,112,115],{},"Every name below is valid in ",[104,105,106],"code",{},"--tools"," and ",[104,109,110],{},"--exclude-tools",". See\n",[113,114,49],"a",{"href":47}," for how filtering works.",[117,118,120],"h2",{"id":119},"read-only","Read-only",[88,122,123],{},"Always allowed, never approval-gated.",[125,126,127,140],"table",{},[128,129,130],"thead",{},[131,132,133,137],"tr",{},[134,135,136],"th",{},"Tool",[134,138,139],{},"What it does",[141,142,143,154,164,174,188,198,213,223,233,245,255,265],"tbody",{},[131,144,145,151],{},[146,147,148],"td",{},[104,149,150],{},"read",[146,152,153],{},"Read a UTF-8 text file as numbered lines. Pages large files with offset\u002Flimit",[131,155,156,161],{},[146,157,158],{},[104,159,160],{},"ls",[146,162,163],{},"List a directory's entries: name, kind, size",[131,165,166,171],{},[146,167,168],{},[104,169,170],{},"glob",[146,172,173],{},"Find files by glob pattern, as relative paths",[131,175,176,181],{},[146,177,178],{},[104,179,180],{},"search",[146,182,183,184,187],{},"Regex search over file contents, ranked, returned as ",[104,185,186],{},"path:line:content",". Searches everything by default, dependencies included",[131,189,190,195],{},[146,191,192],{},[104,193,194],{},"outline",[146,196,197],{},"A source file's structure (functions, classes, methods) with line numbers, via tree-sitter, without dumping the file",[131,199,200,205],{},[146,201,202],{},[104,203,204],{},"grok_sink",[146,206,207,208,212],{},"Given a symbol or API name, return its definitions ",[209,210,211],"strong",{},"and"," every call site in the repo, split production vs test",[131,214,215,220],{},[146,216,217],{},[104,218,219],{},"scan_sinks",[146,221,222],{},"Sweep the repo for all known sinks of a vulnerability class: command injection, SQL injection, deserialization, path traversal, SSRF, code eval, memory safety, …",[131,224,225,230],{},[146,226,227],{},[104,228,229],{},"trace_callers",[146,231,232],{},"Reverse-BFS up the call graph from a symbol toward entry points, grouping call sites by enclosing function",[131,234,235,240],{},[146,236,237],{},[104,238,239],{},"trace_callees",[146,241,242,243],{},"Forward-BFS down the call graph from a symbol toward sinks, grouping the callees invoked inside each function - the downward mirror of ",[104,244,229],{},[131,246,247,252],{},[146,248,249],{},[104,250,251],{},"kb_search",[146,253,254],{},"Search the bundled security-knowledge base: what a weakness class is, how it shows up in code, how to verify it, what neutralises it",[131,256,257,262],{},[146,258,259],{},[104,260,261],{},"code_search",[146,263,264],{},"Concept retrieval over the repo: hybrid BM25 plus TF-IDF vector retrieval, fused, with a security prior",[131,266,267,272],{},[146,268,269],{},[104,270,271],{},"find",[146,273,274,275,277,278],{},"Router: classifies a raw query and dispatches it, a bare symbol to ",[104,276,204],{}," and a concept phrase to ",[104,279,261],{},[88,281,282,284,285,287],{},[104,283,194],{}," before ",[104,286,150],{}," is the intended reflex: an outline of a 4,000-line file costs a fraction of\nits text and usually answers the question.",[117,289,291],{"id":290},"execution-and-mutation","Execution and mutation",[88,293,294,295,298],{},"These run code or write to disk in the target root, so every one of them is flagged ",[209,296,297],{},"dangerous","\nand goes through the approval gate.",[125,300,301,309],{},[128,302,303],{},[131,304,305,307],{},[134,306,136],{},[134,308,139],{},[141,310,311,321,331,345,355],{},[131,312,313,318],{},[146,314,315],{},[104,316,317],{},"bash",[146,319,320],{},"Run a shell command in the sandboxed target root. Sequential",[131,322,323,328],{},[146,324,325],{},[104,326,327],{},"execute",[146,329,330],{},"Think-in-code: run an analysis script over the target and get back only its stdout. One script replaces many read\u002Fsearch calls. Sandboxed, sequential",[131,332,333,338],{},[146,334,335],{},[104,336,337],{},"edit",[146,339,340,341,344],{},"Replace exact text in an existing file, as one edit or a batch. Every ",[104,342,343],{},"old_string"," must appear exactly once",[131,346,347,352],{},[146,348,349],{},[104,350,351],{},"write",[146,353,354],{},"Create a file, or replace one whole. Parent directories are created",[131,356,357,362],{},[146,358,359],{},[104,360,361],{},"reproduce",[146,363,364,365,368],{},"Run a PoC against a structured vulnerability ",[104,366,367],{},"claim"," and get a deterministic verdict from the crash oracle: segfault, abort, ASan signal, or a sentinel match",[88,370,371],{},"One more tool belongs to this story without belonging to this list:",[125,373,374,382],{},[128,375,376],{},[131,377,378,380],{},[134,379,136],{},[134,381,139],{},[141,383,384],{},[131,385,386,391],{},[146,387,388],{},[104,389,390],{},"coverage",[146,392,393,394,397],{},"Check whether a sink line executed, by ",[209,395,396],{},"parsing"," an lcov report your PoC already produced (coverage.py, c8, nyc, gcov, llvm-cov)",[88,399,400,402],{},[104,401,390],{}," runs nothing. It reads a file your own instrumented run wrote, which is why it is not\ndangerous and is allowed without an approval prompt.",[404,405,407],"h3",{"id":406},"proof-and-diagnostics-are-not-the-same-artifact","Proof and diagnostics are not the same artifact",[88,409,410,411,414],{},"Every one of these tools records an auditable artifact. Only some of those artifacts are ",[209,412,413],{},"proof",".",[88,416,417,418,420,421,424,425,428],{},"A proof artifact carries two extra things: a structured ",[209,419,367],{}," (which file and line, or which\nexact URL; which vulnerability class; what security effect the oracle must observe) and a\nmachine-checked ",[209,422,423],{},"assertion"," that ",[92,426,427],{},"passed",". Three tools can mint one:",[125,430,431,440],{},[128,432,433],{},[131,434,435,437],{},[134,436,136],{},[134,438,439],{},"Mints proof when",[141,441,442,462,472],{},[131,443,444,448],{},[146,445,446],{},[104,447,361],{},[146,449,450,451,453,454,457,458,461],{},"Its ",[104,452,367],{}," is supplied and the oracle ",[209,455,456],{},"triggered"," - a native crash\u002Fsanitizer signal, or your ",[104,459,460],{},"sentinel"," appearing in the output",[131,463,464,469],{},[146,465,466],{},[104,467,468],{},"run_module",[146,470,471],{},"A scanner module confirms a detection. One artifact per confirmed finding, carrying that module's payload, location and detector condition",[131,473,474,479],{},[146,475,476],{},[104,477,478],{},"replay_request",[146,480,481,482,485,486,485,489,485,491,493,494],{},"You pass ",[104,483,484],{},"param"," + ",[104,487,488],{},"payload",[104,490,367],{},[104,492,423],{},", and the marker appears in the mutated response while being ",[209,495,496],{},"absent from the benign baseline",[88,498,499],{},"Everything else is diagnostic, and says so in its own citation line:",[501,502,503,518,532,544],"ul",{},[504,505,506,510,511,514,515,517],"li",{},[209,507,508],{},[104,509,327],{}," mints an ",[104,512,513],{},"exec"," artifact and nothing more. Exit zero proves the script ran; a nonzero\nexit may just be the script's own bug. It never evaluated an exploit assertion, so it cannot\npromote a severity - build the PoC under ",[104,516,361],{}," instead.",[504,519,520,525,526,531],{},[209,521,522,524],{},[104,523,361],{}," that did not trigger",", and ",[209,527,528,530],{},[104,529,468],{}," that confirmed nothing",", are recorded so\nthe attempt is on the record. A failed assertion is not a passed one.",[504,533,534,543],{},[209,535,536,538,539,485,541],{},[104,537,478],{}," without ",[104,540,367],{},[104,542,423],{}," is a manual probe. So is one whose marker was\nalready in the baseline: that is the response behaving normally, not the mutation causing it.",[504,545,546,550],{},[209,547,548],{},[104,549,390],{}," reaches a sink without crashing. That tells you the path is live, not that it is\nexploitable.",[88,552,553,554,557,558,561,562,565,566,569,570,573,574,107,577,580],{},"The claim also has to be about ",[92,555,556],{},"this"," finding. A perfectly real artifact minted for a different bug\ndoes not transfer, which is why a High\u002FCritical finding must carry a ",[104,559,560],{},"file"," (or an exact DAST URL)\nand, for a source finding, a ",[104,563,564],{},"line",". All four severity gates - ",[104,567,568],{},"record_finding",", ",[104,571,572],{},"score_finding",",\n",[104,575,576],{},"report_findings",[104,578,579],{},"cross_verify"," - route through the same predicate, so they cannot drift apart.",[117,582,584],{"id":583},"findings-and-memory","Findings and memory",[125,586,587,595],{},[128,588,589],{},[131,590,591,593],{},[134,592,136],{},[134,594,139],{},[141,596,597,606,615,624,647,667],{},[131,598,599,603],{},[146,600,601],{},[104,602,568],{},[146,604,605],{},"Record a finding, or an unconfirmed lead. CWE and CVSS are filled in later",[131,607,608,612],{},[146,609,610],{},[104,611,572],{},[146,613,614],{},"Score a recorded finding from a CVSS 3.1 or 4.0 vector. Computes the base score and severity deterministically, and applies the severity gate",[131,616,617,621],{},[146,618,619],{},[104,620,576],{},[146,622,623],{},"Render the session's findings, gated to the reporting bar (default: High and above) and sorted by severity",[131,625,626,631],{},[146,627,628],{},[104,629,630],{},"scratchpad",[146,632,633,634,637,638,637,641,637,644],{},"Short-term per-session notes. Survives compaction. ",[104,635,636],{},"set"," \u002F ",[104,639,640],{},"get",[104,642,643],{},"list",[104,645,646],{},"delete",[131,648,649,654],{},[146,650,651],{},[104,652,653],{},"memory",[146,655,656,657,637,659,637,661,637,663,637,665],{},"Long-term scoped memory across sessions. ",[104,658,636],{},[104,660,640],{},[104,662,643],{},[104,664,180],{},[104,666,646],{},[131,668,669,674],{},[146,670,671],{},[104,672,673],{},"recall",[146,675,676,677,680,681],{},"Search the ",[209,678,679],{},"full"," transcript, tool output compaction has elided out of the live context included, for ranked snippets, or fetch an exact ",[104,682,683],{},"seq",[88,685,686,687,689],{},"Severity is computed, never asserted. ",[104,688,572],{}," takes a CVSS vector and derives the score and\nseverity from it, so a finding cannot be talked up a band.",[88,691,692,694,695,698,699,701],{},[104,693,673],{}," is what makes elision safe: compaction removes old tool output from the ",[92,696,697],{},"live"," context, but\nthe transcript still holds it, and the agent can go back for it by search or by sequence number.\nAlong with ",[104,700,576],{}," it carries the same read-only flag the recon tools do, since both only read\nstores locac itself wrote.",[117,703,705],{"id":704},"orchestration","Orchestration",[125,707,708,716],{},[128,709,710],{},[131,711,712,714],{},[134,713,136],{},[134,715,139],{},[141,717,718,740,750,764,773,783,793,803,817],{},[131,719,720,725],{},[146,721,722],{},[104,723,724],{},"spawn_subagent",[146,726,727,728,731,732,735,736,739],{},"Launch a fresh-context child ",[209,729,730],{},"as a role",": ",[104,733,734],{},"surface-mapper"," for read-only recon, ",[104,737,738],{},"exploit-verifier"," to independently reproduce a candidate. Returns an id. Findings it records land in this session",[131,741,742,747],{},[146,743,744],{},[104,745,746],{},"wait_subagent",[146,748,749],{},"Block until a child finishes; returns its typed report plus status and turn count",[131,751,752,757],{},[146,753,754],{},[104,755,756],{},"steer_subagent",[146,758,759,760,763],{},"Send guidance to a ",[92,761,762],{},"running"," child, picked up at its next decision point. A no-op once it has finished",[131,765,766,770],{},[146,767,768],{},[104,769,579],{},[146,771,772],{},"The 2-of-3 quorum: fan out three independent verifiers (reproduce \u002F refute \u002F boundary), tally, record the outcome",[131,774,775,780],{},[146,776,777],{},[104,778,779],{},"switch_worktree",[146,781,782],{},"Relocate the session into an isolated git worktree at a chosen ref, to reproduce against a specific release without touching the main checkout. Ends the run; resume to continue there. Dangerous",[131,784,785,790],{},[146,786,787],{},[104,788,789],{},"update_plan",[146,791,792],{},"Post or revise the working checklist, so you can see where the agent is. The whole plan is sent each time and replaces the previous one",[131,794,795,800],{},[146,796,797],{},[104,798,799],{},"present_plan",[146,801,802],{},"Conclude the plan phase and submit a plan for approval. Ends the run",[131,804,805,810],{},[146,806,807],{},[104,808,809],{},"ask_user",[146,811,812,813,816],{},"Put a structured question to the operator: up to four questions, each with 2-4 options and an optional ",[104,814,815],{},"multiSelect",", plus an always-present free-text \"Other\" row. Orchestrator-only",[131,818,819,824],{},[146,820,821],{},[104,822,823],{},"submit_report",[146,825,826],{},"A child's final typed report. Ends that child's run. Called exactly once",[88,828,829,830,569,832,107,834,836,837,839,840,842],{},"A subagent cannot spawn subagents. ",[104,831,724],{},[104,833,746],{},[104,835,756],{}," are never\nin a child's tool set, and ",[104,838,823],{}," is always added to it. ",[104,841,809],{}," is orchestrator-only for\nthe same reason from the other side: a child runs with no operator to ask, so it is never in a role's\ntool set either.",[404,844,809],{"id":809},[88,846,847,849],{},[104,848,809],{}," is how the agent hands a decision back to the person running the audit rather than guessing:\nwhich of several leads to chase first, whether a behaviour counts as in-scope, which credential set to\nassume. In the TUI it renders as a modal that blocks the turn until answered, the same way the\ndangerous-tool approval prompt does; the free-text \"Other\" row lets the operator type an answer none of\nthe options cover.",[88,851,852,853,856],{},"Run without an interactive terminal - piped, ",[104,854,855],{},"--print",", a role child, CI - there is no operator to ask,\nso it degrades deterministically: it auto-selects each question's first option, notes that it did, and\nthe run never stalls waiting on input that will not arrive.",[404,858,860],{"id":859},"the-cross-verify-quorum","The cross-verify quorum",[88,862,863,866],{},[104,864,865],{},"cross_verify(finding_id)"," runs three verifiers with different lenses:",[501,868,869,875,881],{},[504,870,871,874],{},[209,872,873],{},"reproduce."," Build the PoC from scratch and run it.",[504,876,877,880],{},[209,878,879],{},"refute."," Find the sanitiser that makes this a false positive.",[504,882,883,886,887,890],{},[209,884,885],{},"boundary."," Confirm it fires in the ",[92,888,889],{},"default"," deployment.",[88,892,893,894,897,898,901,902,908,909,525,912,915],{},"A vote counts only if that verifier reproduced the bug ",[209,895,896],{},"itself"," during this round and cites proof\nthat clears four separate checks: minted ",[209,899,900],{},"during this round"," (a pre-existing artifact is a\nreceipt, not a verification), ",[209,903,904,905],{},"bound to the exact ",[104,906,907],{},"finding_id"," it was asked to vote on, matching\nthat finding's ",[209,910,911],{},"location",[209,913,914],{},"distinct"," from what the other two lenses cited. Re-citing the\ncandidate's artifact, citing a fresh artifact about some other path, or three lenses sharing one\nartifact all fail. Two of three must promote.",[88,917,918,919,921],{},"The ",[104,920,907],{}," requirement is why the verifiers are told the id, not just the location: a URL can\nhost several bug classes at once, and a claim naming only the URL would let one of them vouch for\nanother.",[88,923,924,925,414],{},"A High or Critical finding cannot be promoted or reported without a passing quorum, so this runs\nbefore ",[104,926,572],{},[117,928,930],{"id":929},"dast","DAST",[88,932,933,934,414],{},"Present only when a run wires a DAST store. These send ",[209,935,936],{},"live requests",[125,938,939,947],{},[128,940,941],{},[131,942,943,945],{},[134,944,136],{},[134,946,139],{},[141,948,949,961,978],{},[131,950,951,956],{},[146,952,953],{},[104,954,955],{},"crawl",[146,957,958,959],{},"Same-origin crawl of a target to map pages, query parameters and forms into the scan record. Run before ",[104,960,468],{},[131,962,963,967],{},[146,964,965],{},[104,966,468],{},[146,968,969,970,973,974,977],{},"Run active scanner modules over the crawled record, or a single URL, to confirm reflected XSS, error-based SQLi, template injection (",[104,971,972],{},"ssti",", CWE-1336), time-based OS command injection (",[104,975,976],{},"cmdi",", CWE-78), open redirect and path traversal dynamically. Probes inject into query and form params, JSON body leaves, request headers and cookies",[131,979,980,984],{},[146,981,982],{},[104,983,478],{},[146,985,986],{},"Re-send a recorded request, optionally mutating one parameter, and return the status plus a body snippet",[88,988,989,990,992],{},"Naming a DAST tool in ",[104,991,106],{}," on a run that has no DAST store is not an error. It is simply a\nno-op there.",[88,994,995,1000,1001,1003,1004,1006],{},[209,996,997,999],{},[104,998,468],{}," is detection-scoped."," It mints one artifact per confirmed detection rather than one\nper scan, so \"a scan ran here\" can never stand in for \"this parameter is injectable\". Pass\n",[104,1002,907],{}," to re-verify a DAST finding that already exists: the artifact is bound to that id only\nwhen the URL ",[209,1005,211],{}," the class (CWE, or the title when there is no CWE) both match, and no duplicate\nfinding row is written. That is the call a cross-verify lens makes.",[88,1008,1009,1014,1015,485,1017,1019,1020,107,1022,1024,1025,485,1027,1029],{},[209,1010,1011,1013],{},[104,1012,478],{}," proves nothing on its own."," With ",[104,1016,367],{},[104,1018,423],{}," it becomes differential:\nlocac sends the benign request first, then the mutated one, and the assertion passes only if the\nmarker is absent from the baseline and present after the mutation. Both ",[104,1021,367],{},[104,1023,423],{}," must\nbe supplied together, and both require ",[104,1026,484],{},[104,1028,488],{}," - there is no baseline to compare\nagainst otherwise.",[117,1031,1033],{"id":1032},"the-approval-gate","The approval gate",[125,1035,1036,1046],{},[128,1037,1038],{},[131,1039,1040,1043],{},[134,1041,1042],{},"Category",[134,1044,1045],{},"Default decision",[141,1047,1048,1056,1066],{},[131,1049,1050,1053],{},[146,1051,1052],{},"Read-only tools",[146,1054,1055],{},"Allow",[131,1057,1058,1061],{},[146,1059,1060],{},"Dangerous tools",[146,1062,1063],{},[209,1064,1065],{},"Ask",[131,1067,1068,1071],{},[146,1069,1070],{},"Everything else",[146,1072,1055],{},[88,1074,1075,1076,569,1078,569,1080,569,1082,569,1084,569,1086,573,1088,569,1090,569,1092,414],{},"The dangerous set is exactly: ",[104,1077,317],{},[104,1079,327],{},[104,1081,337],{},[104,1083,351],{},[104,1085,361],{},[104,1087,955],{},[104,1089,468],{},[104,1091,478],{},[104,1093,779],{},[88,1095,1096],{},"Resolution order for any one call: a per-tool rule (last match wins) beats the\ndangerous\u002Fread-only category, which beats the default.",[88,1098,1099],{},"What \"ask\" resolves to depends on the run:",[125,1101,1102,1112],{},[128,1103,1104],{},[131,1105,1106,1109],{},[134,1107,1108],{},"Situation",[134,1110,1111],{},"Result",[141,1113,1114,1122,1132,1148],{},[131,1115,1116,1119],{},[146,1117,1118],{},"TUI on a real terminal",[146,1120,1121],{},"An interactive y\u002Fn\u002Fa overlay",[131,1123,1124,1129],{},[146,1125,1126],{},[104,1127,1128],{},"--auto",[146,1130,1131],{},"Read-only shell commands auto-approved; everything else fail-closed",[131,1133,1134,1145],{},[146,1135,1136,637,1139,637,1142],{},[104,1137,1138],{},"--yes",[104,1140,1141],{},"-y",[104,1143,1144],{},"--allow-all",[146,1146,1147],{},"Approved",[131,1149,1150,1156],{},[146,1151,1152,1153,1155],{},"Anything else (piped, ",[104,1154,855],{},", CI)",[146,1157,1158,1161],{},[209,1159,1160],{},"Denied",", fail-closed",[88,1163,1164,1165,1167],{},"In plan mode every dangerous tool is blocked with a reason the model can read, while read-only\ntools, the findings tools and ",[104,1166,799],{}," stay available.",[117,1169,1171],{"id":1170},"filtering","Filtering",[1173,1174,1178],"pre",{"className":1175,"code":1176,"language":317,"meta":1177,"style":1177},"language-bash shiki shiki-themes vitesse-dark","locac run \"…\" --tools \"read,search,outline,code_search,trace_callers\"\nlocac run \"…\" --exclude-tools \"bash,execute\"\n","",[104,1179,1180,1213],{"__ignoreMap":1177},[1181,1182,1183,1187,1191,1195,1198,1201,1205,1207,1210],"span",{"class":564,"line":29},[1181,1184,1186],{"class":1185},"sCK9x","locac",[1181,1188,1190],{"class":1189},"s7rlk"," run",[1181,1192,1194],{"class":1193},"sNJcY"," \"",[1181,1196,1197],{"class":1189},"…",[1181,1199,1200],{"class":1193},"\"",[1181,1202,1204],{"class":1203},"sXjYR"," --tools",[1181,1206,1194],{"class":1193},[1181,1208,1209],{"class":1189},"read,search,outline,code_search,trace_callers",[1181,1211,1212],{"class":1193},"\"\n",[1181,1214,1215,1217,1219,1221,1223,1225,1228,1230,1233],{"class":564,"line":33},[1181,1216,1186],{"class":1185},[1181,1218,1190],{"class":1189},[1181,1220,1194],{"class":1193},[1181,1222,1197],{"class":1189},[1181,1224,1200],{"class":1193},[1181,1226,1227],{"class":1203}," --exclude-tools",[1181,1229,1194],{"class":1193},[1181,1231,1232],{"class":1189},"bash,execute",[1181,1234,1212],{"class":1193},[501,1236,1237,1248,1251,1258,1263],{},[504,1238,1239,1241,1242,1245,1246,414],{},[104,1240,110],{}," is applied ",[209,1243,1244],{},"after"," ",[104,1247,106],{},[504,1249,1250],{},"Both accept comma-separated names, which are trimmed, de-duplicated and sorted into a canonical\nform.",[504,1252,1253,1254,1257],{},"The filter applies to ",[209,1255,1256],{},"every"," harness the run builds, role children included.",[504,1259,1260,1262],{},[104,1261,823],{}," cannot be removed by either flag, because a child has to be able to answer its parent.",[504,1264,1265],{},"An unknown name is a startup error, not a silent no-op:",[1173,1267,1272],{"className":1268,"code":1270,"language":1271,"meta":1177},[1269],"language-text","error: unknown tool \"raed\" in --tools (known: bash, code_search, coverage, …)\n","text",[104,1273,1270],{"__ignoreMap":1177},[117,1275,1277],{"id":1276},"next","Next",[88,1279,1280,107,1282,1284,1285,1287],{},[113,1281,36],{"href":35},[113,1283,18],{"href":17}," cover what the model\nruns on; the ",[113,1286,23],{"href":22}," has the filtering flags in full.",[1289,1290,1291],"style",{},"html pre.shiki code .sCK9x, html code.shiki .sCK9x{--shiki-default:#80A665}html pre.shiki code .s7rlk, html code.shiki .s7rlk{--shiki-default:#C98A7D}html pre.shiki code .sNJcY, html code.shiki .sNJcY{--shiki-default:#C98A7D77}html pre.shiki code .sXjYR, html code.shiki .sXjYR{--shiki-default:#C99076}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":1177,"searchDepth":41,"depth":41,"links":1293},[1294,1295,1298,1299,1303,1304,1305,1306],{"id":119,"depth":33,"text":120},{"id":290,"depth":33,"text":291,"children":1296},[1297],{"id":406,"depth":41,"text":407},{"id":583,"depth":33,"text":584},{"id":704,"depth":33,"text":705,"children":1300},[1301,1302],{"id":809,"depth":41,"text":809},{"id":859,"depth":41,"text":860},{"id":929,"depth":33,"text":930},{"id":1032,"depth":33,"text":1033},{"id":1170,"depth":33,"text":1171},{"id":1276,"depth":33,"text":1277},"Every tool the agent can call, from read-only to mutating, findings, orchestration and DAST, with which ones are approval-gated and which ones can mint a proof artifact.","md",{},true,{"title":64,"description":1307},"docs\u002Ftools","ICdWQRu1PKcosHQzPrZacoSVTWS_GLqrusAPB8EvoTo",1786794387121]