diff

What diff does on Lint

AI agents call diff to retrieve information from Lint without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why diff is rated Low

The `diff` tool is purely informational; it reads and reports differences between file versions. There are no side effects, no data modification, no code execution, and no destructive operations. The optional patch content is still just data presentation. This is a classic Read category operation analogous to a diff command used for inspection and analysis.

From the tool's definition Tool returns 'file-level diff statistics as structured data' with optional 'patch content' - it retrieves and presents file differences without modifying files or executing code. The verb 'returns' and 'structured data' indicate read-only retrieval.

The rule that runs diff safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Lint, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For diff, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "diff": {}
  }
}

Questions about diff