@cognitive-fab/polycheck

A least-privilege linter for Claude Code agent policies. Ingests a repo's .claude settings + MCP config and outputs a proof (every path into a forbidden region crosses a gate) or a witness: a concrete sequence of allowed tool calls that reaches credential