symbi-tool-review

Tool-review workflow client for the Symbiont JavaScript/TypeScript SDK. Submit tools for security analysis, track review sessions, and act on reviewer decisions before a tool is allowed to execute under the Symbiont runtime.

Most users install symbi-core, which exposes this as client.toolReview. Pull symbi-tool-review directly when you want a narrow dependency for a dashboard or review UI.

Install

npm install symbi-tool-review

Usage

import { ToolReviewClient } from 'symbi-tool-review';

const review = new ToolReviewClient(transport);

// Submit a tool for review
const submission = await review.submitTool({
  name: 'nmap-scan',
  manifestPath: '/tools/nmap.clad.toml',
  requester: 'team-security',
});

// Poll the session
const session = await review.getSession(submission.sessionId);
console.log(session.state, session.analysis?.findings);

// Record a human reviewer decision
await review.recordDecision(session.id, {
  decision: 'approved',
  reviewer: '[email protected]',
  notes: 'Read-only; no external network writes.',
});

Exports

| Export | Purpose | |--------|---------| | ToolReviewClient | Submit / get / list review sessions, record decisions, retrieve security analysis results |

Types re-exported from symbi-types: ToolSubmission, ReviewSession, SecurityAnalysis, ReviewDecision, and related enums.

See also

• symbi-core — exposes client.toolReview
• SDK README
• docs.symbiont.dev/security-model — where tool review fits in the Trust Stack

License

Apache 2.0. See LICENSE.