check_policy
Check if a specific action (tool call, secret read, or command execution) would be allowed by the project's policy without performing it. Use as a dry-run before executing blocked operations.
Instructions
[policy] Ask whether a single intended action would be allowed by the project's .q-ring.json policy without actually performing it. Use as a dry-run before calling a potentially-blocked tool, attempting to read a sensitive key, or invoking exec_with_secrets with a non-trivial command; prefer get_policy_summary for a one-shot overview of the entire policy. Read-only. Returns JSON { allowed, reason?, policySource } describing the decision. Returns an error 'Missing required parameter for the selected action type' if the matching argument for the chosen action is not supplied.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Secret key name to evaluate. Required when `action` is 'key_read'. | |
| action | Yes | Which policy surface to query. 'tool' = MCP tool gate (needs `toolName`); 'key_read' = secret read gate (needs `key`); 'exec' = exec_with_secrets command gate (needs `command`). | |
| command | No | Command to evaluate against the exec allowlist/denylist. Required when `action` is 'exec'. | |
| toolName | No | Tool id to evaluate, e.g. 'rotate_secret'. Required when `action` is 'tool'. | |
| projectPath | No | Absolute path to the project root for project-scoped secrets and policy resolution. Defaults to the MCP server's current working directory when omitted. |