Audits unified git diffs or Pull Requests for AI-hallucinated NPM/PyPI packages, typosquatting attacks, unauthorized boundary imports, and leaked secrets. Use when: Verifying code changes from AI coding agents (Cursor, Claude Code, Copilot) or reviewing PRs before merging into production repositories. Do not use when: Pruning TypeScript/JavaScript AST syntax or linting container Dockerfiles. Alternative: Use tokenprune_wasm_trim for AST prompt reduction, or dockerlean_wasm_audit for Dockerfile linting. Execution: Runs locally in-memory (<5ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Performs sub-millisecond offline Radix Trie Longest Prefix Match (LPM) on any IPv4 address to classify traffic as Datacenter/Cloud (AWS, GCP, Azure, Hetzner), VPN, Tor Exit Node, Public Proxy, or Clean Residential. Use when: Authenticating incoming HTTP requests, preventing bot scraping abuse, or assessing IP risk in auth flows without third-party network latency. Do not use when: Performing DNS lookups, WHOIS domain queries, or analyzing SQL databases. Alternative: Use sqltwin_stream_anonymize for database sanitization, or agentpr_guard_audit for code review. Execution: Runs locally in-memory (<0.01ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Statically lints and audits Dockerfiles for layer bloat, cache-busting RUN ordering, root user vulnerabilities, missing multi-stage build patterns, and excessive image footprint. Use when: Reviewing container configurations, CI/CD pipeline Dockerfiles, or developer images to minimize image size and security risks. Do not use when: Auditing git diffs or evaluating Terraform infrastructure plans. Alternative: Use agentpr_guard_audit for git diff security, or terracost_blast_evaluate for cloud infrastructure cost deltas. Execution: Runs locally in-memory (<5ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Parses raw SEC Form 4 and Form 8-K XML filings to extract C-suite insider transactions, open-market cluster purchases, vesting events, and calculate quantitative managerial conviction scores. Use when: Tracking corporate executive open-market purchases, insider sentiment, and institutional governance changes in financial workflows. Do not use when: Anonymizing SQL databases or evaluating container layer bloat. Alternative: Use sqltwin_stream_anonymize for database sanitization, or dockerlean_wasm_audit for container optimization. Execution: Runs locally in-memory (<5ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Analyzes multiple historical JUnit XML test run reports using two-state Markov chain transition matrices to statistically separate genuinely broken tests from nondeterministic flaky tests. Generates quarantine recommendations and test stability manifests. Use when: Triage of intermittent CI/CD pipeline failures, isolating nondeterministic test suites, and calculating test failure probability. Do not use when: Auditing unified git diffs or parsing database dumps. Alternative: Use agentpr_guard_audit for git security audits, or sqltwin_stream_anonymize for database anonymization. Execution: Runs locally in-memory (<10ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Calculates 3D physical shipping carton packing arrangements for warehouse packages and e-commerce items using First-Fit Decreasing (FFD) and Extreme Point heuristics with full 6-axis orthogonal rotations. Use when: Optimizing warehouse carton selection, freight volumetric weight calculation, and logistics order fulfillment. Do not use when: Auditing code diffs, analyzing Terraform infrastructure, or performing software security reviews. Alternative: Use agentpr_guard_audit for PR security audits, or terracost_blast_evaluate for cloud infrastructure plans. Execution: Runs locally in-memory (<15ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Streams and anonymizes PostgreSQL and MySQL database dumps, replacing PII (emails, phone numbers, names, IBANs) with synthetic values using HMAC format-preserving encryption while preserving 100% of foreign key joins, relational referential integrity, and unique constraints. Use when: Preparing staging or developer test database copies from production SQL dumps without exposing real user identities. Do not use when: Parsing financial SEC EDGAR filings or classifying IP addresses. Alternative: Use edgarpulse_parse_filing for SEC regulatory filings, or cidr_shield_lookup for IP address classification. Execution: Runs locally in-memory (<10ms), deterministic, zero network calls, zero telemetry, air-gapped deterministic.

Evaluates Terraform plan JSON output to calculate infrastructure blast radius, identify high-risk stateful resource destructions (databases, storage buckets), and compute monthly FinOps cost delta estimations. Use when: Pre-apply CI/CD infrastructure reviews, FinOps budget validation, or assessing destruction risk before applying Terraform changes. Do not use when: Linting container configurations or evaluating test flakiness. Alternative: Use dockerlean_wasm_audit for container optimization, or flaky_quarantine_analyze for CI test stability. Execution: Runs locally in-memory (<10ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.

Prunes TypeScript and JavaScript source code using AST parsing to extract public interfaces, type signatures, and exports while collapsing method implementations into concise summaries. Saves 50%-70% of LLM context window tokens without losing structural semantic information. Use when: Feeding large codebase files or libraries into LLM prompts for high-level architecture reasoning or planning. Do not use when: Auditing git diffs for security vulnerabilities or linting container configurations. Alternative: Use agentpr_guard_audit for PR security verification, or dockerlean_wasm_audit for container optimization. Execution: Runs locally in-memory (<10ms), read-only, idempotent, zero network calls, zero telemetry, air-gapped deterministic.