capability-sentinel

Paste a source file and get a deterministic capability audit - process-execution, network-egress, filesystem-write, listening-socket and environment-read call sites, each with line numbers, plus a count per capability and a one-line verdict (inert vs capability-bearing). Comment and string bodies are masked before matching, so a quoted "fetch(" is not a finding. No LLM, no network call, nothing from your source is executed - it answers "what can this code reach?" before you merge it.