Module capabilities 

Catalog of the semantic-security capabilities the stdlib host functions gate via check_security. This is the single source of truth behind submilli blueprint init, the submilli blueprint capability verbs, and the server’s GET /v1/capabilities, so an operator sees every capability the runtime can gate.

Keep in sync with the host functions. When a host fn in stdlib::fs / stdlib::http (or a new gated module) starts or stops gating a capability, update the matching entry here — see AGENTS.md. The capabilities test in the submilli CLI asserts every example_filter below parses.

Structs

Capability

One gated capability and the policy filter: surface it exposes.

CapabilityGroup

A group of capabilities sharing a source module, for scaffold sectioning.

FilterField

One context field a capability’s filter: expression can match on.

Enums

FieldNormalization

A rewrite the runtime applies to a field’s value before checking it. Call-site derivation applies the same rewrite to a literal argument, so the filter it writes into requires names the value the policy is asked about.

Functions

catalog

Every capability the core packages gate, grouped by source module. An optional package’s capabilities are listed only by catalog_for.

catalog_for

Every capability the packages of stdlib gate, grouped by source module, in catalog’s order: by module name without its submilli: or @ prefix.

find

Look up a core capability by its exact name (templates included, by their literal mcp.<server> spelling).

find_any

find among every group the runtime can gate.

find_for

find among the capabilities of stdlib.