Map declared agent tools to resource scope, data class, role and approval condition, and produce a versioned permission matrix with the list of assumptions the run could not make.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
npm run example # examples/clean, exits 0
node bin/agent-permission-map.mjs --root examples/broad # exits 1
node bin/agent-permission-map.mjs --root examples/incomplete # exits 2Read the result
A list this build could not read is never reported as a list that was empty. A tool whose every scope, data class or role reference was refused raises tool-scopes-unreadable, tool-data-classes-unreadable or tool-roles-unreadable — not the "declares no …" sentence, which asserts an absence about a declaration sitting in the file. For the same reason role-grants-nothing stays silent whenever any grant in tools.json went unread: the reference nobody could read may be the one that granted that role.
Scope
Every limit is enforced and named when it is reached, and exceeding one makes the run incomplete rather than truncating silently. The defaults and their caps are in docs/permission-rules.md.