Your AI tools have more ways to act than you think. Mockingbird maps those capabilities, sets the boundaries, and tells you when they change.
DEMO MACHINE · SYNTHETIC RULE PACK
Checks run against the actual machine — permission lists, file flags, hooks, snapshots, open database handles. Each reports the evidence it found, not a green tick. The result is a weighted score you can argue with.
Every fixable finding writes a shell script and shows it to you. Read it, then apply — or run it yourself. Settings are backed up before a byte changes.
A hook inspects every tool call before it runs, reading the command and the paths it touches. It sits below the permission list, where a wildcard grant can't step around it.
Re-scans on your cadence. Says when a control that was holding stops holding, when a config file changes underneath you, when the original moves and nothing was supposed to be writing to it.
Controls are weighted by what they cost you when they fail, so the number moves for reasons you can name. Every check shows its working.
No silent remediation. The change is written to disk as a script you can open, before anything runs it.
A permission list sitting beside a general interpreter is advice. The guard reads the command whichever interpreter would have run it.
The guard re-reads its state on every call. Pause takes effect now, resumes itself when you said it should, and keeps logging throughout — so you can see what went through while it was off.
Fingerprints on the files that matter. A control that quietly stopped holding is an event, not something you discover in a quarterly review.
Ships with one rule pack. Every rule is a shell probe you can edit, weight, disable or replace — write your own and the score follows.