Agent Tool Blast Radius Mapper

Map tool capability blast radius, score operational risk, and produce least-privilege policy buckets

3 tools mapped: 1 critical, 0 high, 1 medium, 1 low

{
  "mapped": [
    {
      "name": "docs-search",
      "network": true,
      "capabilities": [
        "search"
      ],
      "riskScore": 25,
      "tier": "low"
    },
    {
      "name": "file-writer",
      "filesystem": true,
      "write": true,
      "capabilities": [
        "write-file"
      ],
      "riskScore": 40,
      "tier": "medium"
    },
    {
      "name": "shell-admin",
      "network": true,
      "filesystem": true,
      "write": true,
      "secrets": true,
      "capabilities": [
        "shell-exec",
        "admin"
      ],
      "riskScore": 100,
      "tier": "critical"
    }
  ],
  "summary": {
    "low": 1,
    "medium": 1,
    "high": 0,
    "critical": 1
  },
  "policy": {
    "allow": [
      "docs-search"
    ],
    "requireApproval": [
      "file-writer"
    ],
    "blockByDefault": [
      "shell-admin"
    ]
  }
}

Updated October 2, 2026. Provided as is. Check the output before you rely on it in production.

How to use Agent Tool Blast Radius Mapper

1

Describe tool capabilities in JSON

List each tool with capability flags such as network, filesystem, write access, secret access, and explicit capability tags.
2

Map blast radius

Run Map Blast Radius to calculate per-tool risk scores and classify each tool into risk tiers.
3

Review generated policy buckets

Use the allow, requireApproval, and blockByDefault buckets as a least-privilege baseline for runtime governance.
4

Apply policy and monitor drift

Commit policy output to your config repo and re-run mapping when tool capabilities change or new tools are introduced.

Questions and answers

What is Agent Tool Blast Radius Mapper?

A tool's blast radius is how much damage it could do if an agent misused it, set by what it can reach: network, files, writes, secrets or a shell. This mapper scores each declared tool from 0 to 100, assigns a low to critical tier, and sorts tools into allow, require-approval and block-by-default lists.

How is risk score calculated?

The score is derived from declared capabilities such as network access, filesystem access, writes, secrets access, and privileged command execution signals.

Does Agent Tool Blast Radius Mapper store or send my data?

No. Mapping and scoring run in-browser and your capability matrix stays private.

For AI agents: how to call this tool

Machine-readable contract, endpoints and examples. Humans can ignore this section.

Best Path For Builders

Browser workflow

Runs instantly in the browser with private local processing and copy/export-ready output.

Browser Workflow

This tool is optimized for instant in-browser execution with local data handling. Run it here and copy/export the output directly.

/agent-tool-blast-radius-mapper/

For automation planning, fetch the canonical contract at /api/tool/agent-tool-blast-radius-mapper.json.

Agent Tool Blast Radius Mapper