Follow-up to the deployment-aware risk scoring feature.
For MCP targets, runAll already connects and calls tools/list before the evaluator loop. Use that live tool surface to derive the Tools / Autonomy factors in deriveAgentProfile() directly (count, write-capability, privilege) instead of relying on businessUseCase text alone.
- Thread the discovered
ToolInfo[] into profile derivation on the MCP path.
- Keep the text heuristic for agent (HTTP/local-script) targets, which have no introspectable tool list.
Follow-up to the deployment-aware risk scoring feature.
For MCP targets,
runAllalready connects and callstools/listbefore the evaluator loop. Use that live tool surface to derive theTools/Autonomyfactors inderiveAgentProfile()directly (count, write-capability, privilege) instead of relying onbusinessUseCasetext alone.ToolInfo[]into profile derivation on the MCP path.