audit

What audit does on Test

AI agents call audit to retrieve information from Test without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why audit is rated Low

This is a read-only security scanning tool. It queries dependency data, checks against vulnerability databases, and returns structured results. There are no side effects, data modifications, code execution, or destructive operations. The blast radius of misuse is minimal—an AI agent could potentially scan unauthorized projects, but this yields only informational data, not harmful actions.

From the tool's definition The tool 'runs cargo audit and returns structured vulnerability data.' Cargo audit is a scanning/reporting tool that checks for known vulnerabilities in Rust dependencies and reports findings without modifying code or executing arbitrary operations.

The rule that runs audit safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Test, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For audit, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit": {}
  }
}

Questions about audit