Keeps user-facing docs in sync with code changes. Use when a PR changes src/ (a tool is added/removed/renamed, an env var changes, or user-facing behaviour changes) and the README or docs may be stale. Also runs automatically on code PRs via the docs-agent workflow.
Reviews changes against this repo's threat model — indirect prompt injection via FreeAgent data, SSRF / bearer-token exfiltration, path traversal through IDs, command injection, and token storage. Use when reviewing diffs that touch client.ts, auth.ts, src/tools/, input validation, or any request-path construction.