[READ] Installed models, each annotated with the allow/deny policy verdict.

Shadow (unsanctioned) models show allowed: false.

Args: target: Ollama target name from config; omit for the default (local).

[READ] Currently loaded models: VRAM footprint + residency expiry.

Args: target: Ollama target name from config; omit for the default.

[READ] License / parameters / capabilities for one model.

Args: model: Model name (e.g. "llama3.2:3b"). target: Ollama target name from config; omit for the default.

[READ] Ollama reachability + version.

Args: target: Ollama target name from config; omit for the default.

[READ] Total VRAM used by loaded models; flag over-budget.

Args: budget_bytes: Optional VRAM budget; models over it are flagged. target: Ollama target name from config; omit for the default.

[WRITE][risk=medium] Pull a model — refused if it violates the deny/allow policy.

Args: model: Model name to pull. target: Ollama target name from config; omit for the default.

[WRITE][risk=high] Delete a local model. Destructive — pass dry_run=True to preview.

Captures the model's manifest so the harness records an undo (re-pull).

An undo is recorded only when the allow/deny policy would permit re-pulling the model. For a denied one the result says reversible=false and explains why, rather than recording a re-pull that undo_apply is bound to refuse. The dry-run preview carries the same verdict, so the caller learns it before the deletion rather than after.

Args: model: Model name to delete. dry_run: If True, return what WOULD be deleted without deleting. target: Ollama target name from config; omit for the default.

[WRITE][risk=medium] Evict a model from VRAM (keep_alive:0).

Args: model: Model name to unload. target: Ollama target name from config; omit for the default.

[READ] Pure content scan of a text for secrets / PII / code / jailbreak.

No Ollama call — a deterministic scan returning findings + a weighted risk band. Use it to pre-check anything before sending it to a local model.

Args: text: The text to scan.

[READ] Query the observed-usage log (route-through prompts + their findings).

Args: model: Filter by model name. risk_level: Filter by risk band (none/low/medium/high/critical). allowed: True = only allowed calls; False = only blocked. since: ISO start timestamp. limit: Max rows.

Returns {"events": [...], "count": N, "returned": N, "limit": L, "truncated": bool}. When truncated is true more prompts were observed than were returned — raise the limit or narrow the filters. Never conclude "no risky prompts were observed" from a truncated result.

[READ] Rollup: shadow models, digest drift, high-risk prompts, blocked count.

Args: target: Ollama target name from config; omit for the default.

[WRITE][risk=medium] Scan + policy-gate a prompt, record it, then run if allowed.

The route-through guard: scans the prompt (secrets/PII/code/jailbreak), checks the model against policy, blocks if the risk band >= block_threshold or the model is disallowed, records the interaction to the usage log, and only calls Ollama if allowed. The raw prompt is never stored.

Args: model: Model to run. prompt: The prompt text (scanned before any model call). agent / user: Actor attribution recorded in the usage log. block_threshold: Block when risk band >= this (none/low/medium/high/critical). target: Ollama target name from config; omit for the default.

[WRITE][risk=medium] Scan + policy-gate a chat exchange, record it, then run if allowed.

Args: model: Model to run. messages: OpenAI-style [{"role","content"}] messages (contents are scanned). agent / user: Actor attribution recorded in the usage log. block_threshold: Block when risk band >= this. target: Ollama target name from config; omit for the default.

[READ] The current model allow/deny policy + provenance digest pins.

[READ] Compare each installed model's digest against its pin; flag drift.

Args: target: Ollama target name from config; omit for the default.

[WRITE][risk=medium] Replace the model allowlist (glob patterns; empty = allow-all).

Args: models: Shell-glob patterns of permitted model names (e.g. ["llama3.", "qwen"]).

[WRITE][risk=medium] Replace the model denylist (deny patterns always win).

Args: models: Shell-glob patterns of forbidden model names.

[WRITE][risk=medium] Pin a model's expected provenance digest (drift detection).

Args: model: Model name. digest: The expected digest to pin (from list_models / model_details).

[READ] How to run the transparent capture proxy, and what it does NOT guarantee.

WRITES NOTHING and starts no listener — it composes the ai-guardian proxy serve command plus the client-side change, and returns the caveat that matters: the proxy is a CHOKEPOINT, not an enforcement boundary. Any client that can still reach the runtime's real port bypasses it entirely, and this tool cannot detect that. Captured traffic is a sample, not the population, until the runtime is unreachable except through the proxy.

Requests are scanned before forwarding; responses stream through uninspected, because buffering them would turn every streaming client into a blocking one. A governed request whose body cannot be parsed is refused, not forwarded.

Args: listen_host: Address the proxy would bind. listen_port: Port the proxy would bind (default 11435). target: Runtime target from config; omit for the default.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so its real risk tier is recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.