audit

What audit does on Npm

AI agents call audit to retrieve information from Npm without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why audit is rated Low

The tool performs a vulnerability audit, which is fundamentally a read operation: it scans dependencies and reports findings without modifying code, installing packages, or executing arbitrary commands. Auditing has no side effects on the codebase or system state. While the tool runs a subprocess (cargo audit), that subprocess is deterministic and read-only in nature, making this a Read category rather than Execute.

From the tool's definition Tool is described as 'Runs cargo audit and returns structured vulnerability data' — the key terms 'audit' (passive inspection) and 'returns' (queries/retrieves) indicate read-only behavior with no modification or execution of external commands beyond…

The rule that runs audit safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Npm, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For audit, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit": {}
  }
}

Questions about audit