Function is_firewallable_tool 

pub fn is_firewallable_tool(name: &str) -> bool

Tools whose large outputs are eligible for the firewall. Explicit file reads are intentionally excluded — they have their own read-mode (lines:, signatures, …).