approval-gateslisted

Classify every tool an AI agent can call as safe to run automatically or requiring human approval, and find the destructive operations that currently have no gate. Checks whether MCP tool annotations match real behaviour, flags tools whose description understates what they do, and produces a permission policy you can adopt. Works on an MCP server, a tool definition file, an OpenAPI spec, or agent tool-handler source. Use when asked whether an agent surface is safe, to review agent permissions or tool authorization, to add human-in-the-loop boundaries, or before letting an agent act on production systems.
agentrel/skills · ★ 0 · AI & Automation · score 73

Install: claude install-skill agentrel/skills

# Approval gates Every tool you expose to an agent is a capability that will eventually fire without a human watching. This skill sorts them into what may run freely and what must stop for a person, and finds the ones currently on the wrong side of that line. Read-only. Produces a policy proposal; never applies it. ## Applies to | | | |---|---| | **Project types** | MCP servers, agent tool surfaces, function-calling schemas, and APIs about to be exposed to an autonomous agent | | **Stage** | Before an agent surface goes to production. Re-run whenever a write capability is added, since that is when a safe surface quietly stops being one | | **Needs** | Tool definitions, and ideally the handler source — reading the implementation is where the real findings come from | | **Skip if** | There is no agent-callable surface yet. This skill audits what is exposed, not whether something should be | Particularly relevant if your tools can send, publish, delete, transfer, or spend. If every tool is read-only, expect a short report saying so. ## How to use ``` /agentrel:approval-gates audit this repository's tool surface /agentrel:approval-gates ./src/mcp audit a specific server directory /agentrel:approval-gates ./tools.json audit a tool definition file ``` Produces `approval-gates-report.md` including a proposed permission policy as JSON, plus a printed summary led by any critical findings. Read-only — the policy is proposed, neve