Run a shell command. Validated against AgentsID permissions. Read commands (ls, cat, grep) typically allowed. Destructive commands (rm, chmod) blocked unless permitted.

Read a file's contents. Restricted to allowed directories. Requires file.read permission.

Write content to a file. Creates parent directories if needed. Requires file.write permission.

Delete a file. Requires file.delete permission.

List files in a directory with size and type info. Requires file.list permission.

Get file metadata (size, type, permissions, timestamps). Requires file.info permission.

Run a SQL query. SELECT/SHOW requires db.read. INSERT/UPDATE requires db.write.. DELETE/DROP requires db.danger.. Supports PostgreSQL, MySQL, SQLite.

Run a git command. Read operations (status, log, diff) require git.read.. Write operations (commit, push) require git.write..

Make an HTTP request. GET requires http.get. POST requires http.post. PUT requires http.put. DELETE requires http.delete.

List environment variables (secrets auto-filtered). Requires env.read permission.

Get a specific environment variable. Secret-named vars (KEY, TOKEN, PASSWORD) require env.read.secret permission.

Set an environment variable. Requires env.write permission.

List running processes sorted by CPU usage. Requires process.read permission.

Get detailed info about a specific process. Requires process.read permission.

Send a signal to a process. Requires process.kill permission.

List current user's cron jobs. Requires cron.read permission.

Add a cron job. Requires cron.write permission.

Remove cron jobs matching a pattern. Requires cron.danger permission.

List Docker containers. Requires container.read permission.

Get detailed info about a Docker container. Requires container.read permission.

View Docker container logs. Requires container.read permission.

Start a stopped Docker container. Requires container.write permission.

Stop a running Docker container. Requires container.write permission.

Remove a Docker container. Requires container.danger permission.

Ping a host. Requires network.read permission.

List listening network ports. Requires network.read permission.

Traceroute to a host. Requires network.read permission.

DNS lookup for a domain. Requires network.read permission.

Get system overview: OS, CPU, memory, disk, uptime. Requires system.read.

Get disk usage for a path. Requires system.read.

Get memory usage breakdown. Requires system.read.

Read last N lines of a log file. Requires log.read.

Search a log file for a pattern. Requires log.read.

Run a command on a remote host via SSH. Permission scoped per host (ssh.hostname). Requires SSH keys configured.

List installed packages. Requires package.read.

Get info about a package. Requires package.read.

Install a package. Requires package.danger.install (high risk).

Run an AWS CLI command. Read ops (ls, describe) require aws.read.{service}. Write ops require aws.write.{service}. Destructive ops (delete, terminate) require aws.danger.{service}.

Run a kubectl command. Read ops (get, describe, logs) require k8s.read.. Write ops (apply, create) require k8s.write.. Destructive ops (delete, drain) require k8s.danger.*.

Store a secret in the encrypted vault. Per-secret derived encryption keys. Requires secrets.write.

List secret names (values never exposed). Requires secrets.read.

Delete a secret from the vault. Requires secrets.danger.

Restrict which tools can use a secret. E.g., scope an API key to only http.post calls. Requires secrets.write.

Set a time-to-live on a secret. After expiry, proxy injection will refuse to use it. Requires secrets.write.

Make an HTTP request with vault secrets injected server-side. The agent NEVER sees the raw secret — Guard substitutes placeholders like {{API_KEY}} with the real value, makes the call, and scrubs secrets from the response. Requires secrets.proxy.

View access log for secrets — who accessed what, when, for what purpose. Requires secrets.read.

View rotation history for a secret. Requires secrets.read.

Detect vault anomalies: expired secrets, broad scopes, stale keys, unusual access patterns. Requires secrets.read.

Check if a tool/action would be allowed without executing it.

List all permission categories and what they control.