Documentation
¶
Overview ¶
Command blastradius answers one question, with no setup and no integration: how much damage can this agent's tools actually do?
Point it at a live MCP server or an existing tool catalog and it classifies every tool by reversibility (internal/classify), then reports the numbers that matter - how many tools take irreversible actions, how many claim to be undoable without any way to actually undo them, and how many nobody can classify without a human looking.
Deliberately zero-dependency on the rest of the system: no Vault, no proxy, no config, no policy bundle. It reads and reports, it never executes a tool or touches a credential. That's the point - it has to be usable before anyone has decided to adopt anything, including by someone evaluating a third-party MCP server they don't run.
--emit-registry turns the scan into a starting tools.yaml, which is the other half of the job: hand-classifying a catalog was the single biggest barrier to getting this system running at all.
Source Files