quox reach

Documented Checked against the CLI's current help and source. Not run end to end. CLI 0.3.1, checked 2026-10-13.

An agent’s governed blast radius: what it may touch, may not, and what cannot be statically known

Command	What it does
`quox reach agent <agentId>`	Compute an agent’s reach: tools, credentials, hosts, egress origins, delegation
`quox reach unused [options] <agentId>`	Predicted-vs-actual least-privilege report: which granted tools/credentials show zero observed use