Commands / kosa8 mcp-policy check

kosa8 mcp-policy check

Ask whether a scope may call a tool, and record the decision

Usage

kosa8 check SERVER TOOL

Answers the same question the gateway asks before forwarding a call, and writes the same audit event, so a dry run and the real thing agree.

Without --scope the policy's own default_scope applies. --scope is a what-if for admins reviewing another team's access; it is recorded in the event, and it does not change what the gateway enforces — scope assignment lives in the signed policy precisely so it cannot be picked locally.

Exits non-zero when the call would be denied, so CI can gate on it.

Options