Commands / kosa8 mcp-policy check
kosa8 mcp-policy check
Ask whether a scope may call a tool, and record the decision
Usage
kosa8 check SERVER TOOL
Answers the same question the gateway asks before forwarding a call, and writes the same audit event, so a dry run and the real thing agree.
With --args the server's argument rules are applied to that JSON, as they would be to a real call; without it only the tool lists are consulted, so a tool whose rules depend on its arguments is reported as the lists see it.
Without --scope the policy's own default_scope applies. --scope is a what-if for admins reviewing another team's access; it is recorded in the event, and it does not change what the gateway enforces — scope assignment lives in the signed policy precisely so it cannot be picked locally.
Exits non-zero when the call would be denied, so CI can gate on it.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--actor | string | who is asking: human, agent or tool | human |
--args | string | the call's arguments as JSON, to apply the server's argument rules as the gateway would | — |
--scope | string | evaluate as this scope (default: the policy's default_scope) | — |