Agent blast-radius calculator
Assume the agent misuses every tool it has. What is the worst outcome, what is irreversible, and do your controls actually constrain it?
Security review does not ask whether the model is good. It asks: assuming it does the wrong thing with every tool it has, what is the worst outcome, and can we undo it? That is answerable from the tool definitions alone.
Controls shrink the radius; they do not shrink the tool set. The only tool that cannot be misused is one the agent does not have — which is why we argue the work sits in scoping the layer beneath the model, not in prompt engineering above it.
Categorisation is inferred from tool names, descriptions and MCP safety annotations. It is a prompt for the conversation a reviewer should have, not a substitute for reading the implementations — a tool called get_report that quietly writes an audit row will be scored as read-only here. Runs in your browser.
Other tools
- EDI viewer & validator (X12 + EDIFACT)
- X.509 certificate decoder
- JSON ↔ XML converter
- CSV ↔ JSON converter
- OpenAPI linter
- MCP tool-definition linter
- OpenAPI → agent tools
- Prompt secret scanner
- Agent cost & context calculator
- Agent-readiness scorecard
- iPaaS readiness assessment
- Modernisation roadmap generator
- Migration risk register
- Cutover runbook builder
- Interface catalogue builder
- Migration wave planner
- Function Point estimator
- Platform migration assessor
- Fixed-width flat file parser
- webMethods flow reader
- SAP IDoc viewer
- SWIFT MT & ISO 20022 viewer
- HL7 v2 message viewer
- XSLT tester
- XPath tester
- CI/CD workflow security linter
- Regex tester & ReDoS checker
- Webhook signature verifier
- SLA & error budget calculator
- Retry & backoff simulator
- JSONPath tester
- JSON Schema generator
- Encoding & mojibake fixer
- JSON formatter & validator
- JSON diff
- Epoch & timestamp converter
- Base64 encoder & decoder
- UUID & ULID generator
- JWT decoder
- Cron expression explainer
- Interface math calculator
- Post-quantum migration matrix
- Post-quantum exposure calculator
These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.