> narrow tools specific things like ripgrep

Ripgrep has the `--pre` flag and `--hostname-bin` flag that enables it to execute arbitrary commands.

> finding files, [...]

Does that tool invoke the `find` command? Because `find` has the `-exec` flag which could then be used to invoke arbitrary commands.

I really think the only safe option is putting your agent in a virtual machine with only a copy of your code (sans credentials), let the agent work, and then copy it back and manually audit it.