{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=jaylabs/audit-play@0.2.1","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/jaylabs/audit-play@0.2.1","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/jaylabs/audit-play@0.2.1","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/jaylabs/audit-play@0.2.1 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Compares the grants an agent was given with the tools it used. By default it looks at every project on this machine. It reads the harness config for MCP servers, rote adapters and play dependencies, the policy files for allow and deny rules, and the transcripts for every tool call and its result. It reports grants never used, tools used without a rule, unused write grants, idle servers, and blocked requests, then proposes a review only least privilege profile. Read only, no network, python3 only. It never revokes anything.","distribution":{"digest":"sha256:100774d1dbfefa292949666b99bf965d02d505134e1022222e0b9d3329944310","mediaType":"application/vnd.modiqo.rote-flow","size":30411,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/jaylabs/audit-play@0.2.1","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/jaylabs/audit-play@0.2.1","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/jaylabs/audit-play@0.2.1.json"},"name":"audit-play","owner":{"kind":"org","slug":"jaylabs"},"parameters":[{"default":"all","description":"Which project to audit. The word all audits every project this machine records, which is what a bare run with no parameters does. A path narrows to one project, selecting its policy files and its transcript directory. A path inside the rote run workspace is the play's own scratch directory rather than a project, so it falls back to all with a warning.","example":"/Users/you/code/my-project","input":{"allowCustom":true,"choices":[],"label":"Project path"},"name":"project_path","required":false,"type":"string"},{"default":"72","description":"How far back to look, in hours, filtered per event on the record timestamp. 0 means the whole recorded history. Shorter than a weekend produces mostly false idleness.","example":"168","input":{"allowCustom":true,"choices":[],"label":"Window hours"},"name":"window_hours","required":false,"type":"string"},{"default":"claude","description":"Which agent harness wrote the transcripts. Only claude is implemented; any other value is a hard fault rather than a silent empty report.","example":"claude","input":{"allowCustom":false,"choices":[{"label":"claude","value":"claude"}],"label":"Harness"},"name":"harness","required":false,"type":"string","validValues":["claude"]},{"default":"has been denied|Permission denied|permission was denied|was denied by|tool use was rejected","description":"Case insensitive regex that marks an errored tool result as a denial rather than an execution failure. Exposed because the harness wording is not a stable contract, and misreading it turns a control that worked into a control that was bypassed.","example":"has been denied|rejected by policy","input":{"allowCustom":true,"choices":[],"label":"Denial patterns"},"name":"denial_patterns","required":false,"type":"string"},{"default":"true","description":"Whether to read subagent transcripts under each session's subagents directory alongside the session transcripts. They hold real tool calls, so excluding them makes every unused finding a floor.","example":"false","input":{"allowCustom":false,"choices":[{"label":"true","value":"true"},{"label":"false","value":"false"}],"label":"Include subagents"},"name":"include_subagents","required":false,"type":"string","validValues":["true","false"]},{"default":"user,project","description":"Comma separated settings scopes to union. Each scope reads its settings.json and settings.local.json.","example":"project","input":{"allowCustom":true,"choices":[],"label":"Policy scopes"},"name":"policy_scopes","required":false,"type":"string"},{"default":"findings","description":"findings prints the top items per class; all prints every row in the least privilege profile.","example":"all","input":{"allowCustom":false,"choices":[{"label":"findings","value":"findings"},{"label":"all","value":"all"}],"label":"Report"},"name":"report","required":false,"type":"string","validValues":["findings","all"]},{"description":"Where the four artifacts are written. Empty means the run workspace working directory.","example":"/tmp/shadow-diff","input":{"allowCustom":true,"choices":[],"label":"Out dir"},"name":"out_dir","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/jaylabs/audit-play@0.2.1 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/jaylabs/audit-play@0.2.1","headlessCommandTemplate":"rote play run https://play.modiqo.ai/jaylabs/audit-play@0.2.1 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-02T16:05:53.410275+00:00","reference":"jaylabs/audit-play@0.2.1","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":4,"installs":0},"steps":{"count":5,"names":["inventory_grants","join_diff","profile","read_policy","read_traces"]},"title":"audit-play","type":"play","version":"0.2.1","visibility":"public"}