CLI that shows exactly what a JS/TS script does before you run it - network calls, filesystem access, shell exec, eval - via AST parsing, not regex.