See what your agent can actually touch.

A tool list tells you what an agent is allowed to do, not what that adds up to. Paste a manifest and permfuzz maps every capability it holds, then runs the rules that catch the combinations people miss: private data plus untrusted input plus a way out, unbounded shell, wildcards, and spend with no ceiling.

It reads declarations and never executes anything. Nothing you paste leaves this browser tab.

12 capability classes10 risk rulesEvery finding cites its evidence

Tool manifest

Load a sample

Mail, notes and chat in one agent. The most common shape, and the one with the most open legs.

Paste your own

A JSON object with a tools array, or a servers array where each server lists its own tools. Scopes and approval flags are read when present.

{
  "agent": "support-triage",
  "description": "Reads the support inbox, drafts replies and files notes.",
  "logging": false,
  "env": [
    "GMAIL_TOKEN",
    "NOTION_TOKEN",
    "SLACK_BOT_TOKEN"
  ],
  "servers": [
    {
      "name": "gmail",
      "transport": "stdio",
      "tools": [
        {
          "name": "search_messages",
          "description": "Search the support mailbox for messages matching a query.",
          "scopes": [
            "gmail.readonly"
          ],
          "approval": "auto"
        },
        {
          "name": "get_message",
          "description": "Read the full body and attachments of an email message.",
          "scopes": [
            "gmail.readonly"
          ],
          "approval": "auto"
        },
        {
          "name": "send_email",
          "description": "Send a reply to a customer, including attachments.",
          "scopes": [
            "gmail.send"
          ],
          "approval": "auto"
        }
      ]
    },
    {
      "name": "notion",
      "transport": "http",
      "tools": [
        {
          "name": "search_pages",
          "description": "Search the internal knowledge base for policy pages.",
          "scopes": [
            "read_content"
          ],
          "approval": "auto"
        },
        {
          "name": "update_page",
          "description": "Update or archive a page in the customer workspace.",
          "scopes": [
            "write_content",
            "*"
          ],
          "approval": "auto"
        }
      ]
    },
    {
      "name": "slack",
      "transport": "http",
      "tools": [
        {
          "name": "post_message",
          "description": "Post a message to a channel or DM a teammate.",
          "scopes": [
            "chat:write"
          ],
          "approval": "auto"
        }
      ]
    },
    {
      "name": "ops",
      "transport": "stdio",
      "tools": [
        {
          "name": "run_command",
          "description": "Run a shell command on the support host for diagnostics.",
          "scopes": [
            "exec"
          ],
          "approval": "auto"
        },
        {
          "name": "read_env",
          "description": "Read an environment variable or secret from the host.",
          "scopes": [
            "secrets:read"
          ],
          "approval": "auto"
        }
      ]
    }
  ]
}

The scan runs in this browser tab. Your manifest is never uploaded.

No scan yet

Paste a tool manifest on the left, or load a sample, to see every capability the agent holds and which of those grants are dangerous.

How the scan works

Each tool is read for name, description and scope.
Those words map to a fixed capability lexicon.
Rules run over the capability set, including combinations across tools.
Every finding cites the tools and text that produced it.

What it does not do

It reads declared grants, not runtime behaviour.
Inferred capabilities are heuristic and can be wrong.
It never executes code or contacts your servers.
A clean result is not a security guarantee.