What the agent blast-radius grade means
deedglass scan grades your own agent setup: how much an agent could change if it went wrong. It starts at 100 and takes points off. The grade always comes with its deductions.
| Deduction | Points | Limit |
|---|---|---|
| Database role is a superuser or has BYPASSRLS | −35 | once |
| Each high finding | −20 | at most 2 |
| Each medium finding | −8 | at most 3 |
| Each write path with no check | −4 | at most 5 |
| Grade | Points |
|---|---|
| A | 90 to 100 |
| B | 80 to 89 |
| C | 65 to 79 |
| D | 50 to 64 |
| F | below 50 |
A write path with no check
A tool that can write, delete or move money, or a table the database role can DELETE or TRUNCATE, that isn't routed through deedglass mcp wrap with an active policy. The superuser and BYPASSRLS findings count once, in the 35, never again as high findings.
What it doesn't measure
- Prompt injection, or what a model might be talked into.
- How a tool behaves at run time, or whether its code is safe.
- Anything outside the configs, packages and database role the scan reads on your machine.
Versions
Every result names its formula version. When the formula changes, old share links keep their version and stay readable.
A means a small blast radius, not a safe agent.