[joepetjr]

Summary

• AA-1. Each analysis pass is now launched with a read-only tool set: only Read, Grep and Glob, an explicit deny list for shell, edit, write and web tools, and no MCP servers. call_claude checks the command before it starts the process and refuses to launch if a restriction is missing or a widening flag is present.
• AA-2. call_claude validates the structured result against the requested schema. A missing, null or wrong-shaped result raises AgentError with the path of the problem, and shows under Coverage gaps. A well-formed empty list still succeeds. Before, a missing result was indistinguishable from "no findings".
• README and SECURITY.md updated.

Plan units: AA-1 narrowed, AA-2 (portfolio remediation 2026-09-29).

Flag check

The three flags used exist in the help text of Claude Code 2.1.285, checked on 2026-09-30: --tools, --disallowedTools, --strict-mcp-config. No test here launches the real CLI, so a live run is still the proof that they behave as intended.

Design decisions to review

• Exit codes are unchanged. A run with gaps still exits 0 and lists them.
• Required fields are now enforced. A result that omits one becomes a gap where it used to be a partial result.
• The schema check is a small built-in: type, required, properties, items. No enums. No new dependency.

Test plan

• AA-1: command allows only the three read tools, denies the rest, disables MCP, and is refused before launch when widened. Seven were red before the change.
• AA-2: absent, null, string-encoded, non-JSON, non-object envelope, missing field, wrong type at top, item and nested level. Eleven were red before the change.
• Full suite locally: exit 0, 184 tests. ruff check . and ruff format --check . clean.

Not in this PR

• Copying audited inputs into an isolated directory. A pass can still read any file the user account can read. SECURITY.md says so.