toolguard

Audit the active toolguard permission configuration for security risks and flag dangerous allow rules and takeover-mode misconfigurations across the whole config hierarchy. Use when asked to security-check, audit, or review the toolguard / Claude Code permission setup, to find risky or over-broad allow rules, to verify takeover mode is sound, or as a start-of-session safety check. Runs a deterministic analyzer first, then optionally offers a deeper, judgement-based AI-assisted assessment. Read-only: it reports findings and proposes fixes but never edits the config.

Curate the active toolguard permission configuration through a guided, conversational review: find redundant, consolidatable, mis-levelled, and confusing rules across the whole config hierarchy, present them grouped by command family with a plain-English before/after, and -- only on explicit, per-item consent -- apply the changes the user approves. Use when asked to clean up, tidy, consolidate, simplify, de-duplicate, or maintain the toolguard / Claude Code permission rules, to shrink an over-grown allow list, or as a periodic config-curation checkpoint (e.g. before a push). Runs a deterministic analyzer for evidence, reasons about it in passes, and never applies anything automatically.