An agent that receives free-form shell output will invent next steps. coverctl returns bounded JSON: passed, summary, domain rows, and on rejection a stable error_code plus remediation.
That boundary does two jobs:
--rootdir, --require, …) are rejected before they reach a toolchain.Read the contract: Rejection schema and Threat model.
Prompt injection against coding agents is not theoretical. If an MCP tool forwards arbitrary flags to pytest or node, a hostile prompt can turn coverage into code execution.
coverctl’s answer is boring and effective: sanitize inputs, reject known-dangerous shapes with stable error codes, and document the schema so agents (and humans) can recover.
Details: Rejection schema. Eval corpus under internal/eval/scenarios/ gates every PR on this boundary.
Security write-ups about agent systems often cite a lethal combination: access to private data, exposure to untrusted content, and ability to communicate externally. coverctl is deliberately narrow: it runs locally, reads coverage profiles and policy you already have, and does not phone home by default.
Opt-in --mcp-telemetry emits JSONL to your stderr for your own pipelines — still no SaaS upload. Platform teams evaluating multi-repo rollout should start from the threat model and platform teams pages.