MCP / tool-description protection
Circinus already tracks where content came from and what it's allowed to cause when an agent reads an issue, a web page, or a changelog. This extends that same seam to an MCP server's own tool descriptions and definitions — so a malicious or silently-drifted tool description can't quietly expand what an agent is permitted to do, the same way untrusted document text can't today.
GitHub / CI agent protection
Bring the same action-boundary decision to an agent running inside a GitHub Actions workflow or other CI context — not only an interactive Claude Code session on a laptop — so a compromised workflow file or a malicious pull-request body can't silently escalate what a CI-triggered agent is allowed to do.
Team policy & centralized authority rules
Let a team define and share a set of authority rules across their own installs — without a hosted control plane or dashboard — so a lead can express "block this class of action for the whole team" once, instead of every teammate hand-editing their own local configuration.