Blast radius
An agent's blast radius is everything it can change with the access it has: which tables, accounts or files it can write, how many rows one call can touch, and which of those changes can't be undone. It's measured from permissions, not from what the agent intends.
An example
Blast radius: C · 4 write paths with no check · fix this first: Archived Postgres MCP server · database not checked
A means a small blast radius, not a safe agent.
−8 medium finding Archived Postgres MCP server
−4 unchecked write path @modelcontextprotocol/server-postgres.query · write · package.json
−4 unchecked write path stripe.refunds.create · money · package.jsonHow Deedglass uses it
The free scan grades the blast radius of your own setup from A to F: it reads your agent client configs and dependencies, counts the tools that can write or move money, and lists what to fix first. It runs read-only and sends nothing. A good grade means a small blast radius, not a safe agent.