Proof before
permission.
A reproducible walkthrough of the native approval boundary, deterministic policy and optional hosted model review.
Start with the installed product
Install version 0.6.0 or newer and follow the setup and verification guide in a disposable Cursor project. The companion and hooks are bundled. The primary demonstration is a real native tool call waiting for a human decision.
- 0:00–0:40: show exact rules and explain that edits require explicit application.
- 0:40–1:30: request a supported whole-file Write, inspect its evidence, reject and verify that the file remains unchanged.
- 1:30–2:20: repeat, approve once and show Cursor resume. Demonstrate an ungranted or sensitive read being blocked locally.
- 2:20–3:00: show the review mode, shell coverage and limitations.
Where NVIDIA and Nebius fit
Eligible LIVE reviews call NVIDIA Nemotron through Nebius Token Factory using authenticated hosted MCP. The local guard first checks policy, bounds evidence and checks outgoing data. Model findings are validated; they cannot override a hard denial or authorize execution.
LIVE requires a privately supplied pilot credential and remaining shared quota. Ask the team for access before judging. If quota is unavailable, show RULES_ONLY honestly. A production review has been verified, but automated functional tests are not an accuracy benchmark.
Hosted sample: no installation
This secondary demo reviews synthetic server-owned files. It cannot inspect your project or intercept native calls. Connect any compatible Streamable HTTP MCP client:
{
"mcpServers": {
"approvallens": {
"url": "https://approvallens-release.vercel.app/api/mcp"
}
}
}Call approvallens_examples, then approvallens_review for the safe-change, protected-change and outside-scope examples. Expect review, block and block respectively in anonymous RULES_ONLY mode. Every result is non-executable. Use a separate client if the native guard denies agent-initiated MCP calls.
Evidence and boundaries
Assess exact scope checks, explicit uncertainty, held requests, state rechecks and human authorization. Native search coverage is not universal. Shell support covers selected literal read-only effects; arbitrary code execution remains blocked. Sensitive-data detection is not a zero-egress guarantee.