Module safety 

Safety profiles — a cheap gate over the Discovery method surface.

One SafetyProfile answers “may this method run?” for both dispatch surfaces: the CLI (grr api call and the generated tree, both gated by the global flags on the root command in cli.rs) and the grr mcp server. The check is a verb + service-name lookup per call — no I/O — so it can sit on every request path.

grr api call gmail.users.messages.send --readonly           # refused: POST
grr api call gmail.users.messages.list --deny-service chat  # allowed
grr mcp --readonly                                          # the server refuses writes

Structs

SafetyArgs

CLI flags for the gate, as a derive struct so cli.rs can flatten it onto the root command without re-declaring the flags. The generated tree and grr api call read them from the root matches (clap merges global args across levels).

SafetyProfile

The safety gate. check runs per method invocation on grr api call, gen_dispatch::dispatch_with_profile and the grr mcp server — one verb + service lookup, never any I/O.

Functions

global_args

The same three flags as global(true) args, for attaching to the root command.