Comply
Comply is part of the AI Agent Lens paid plans. AgentShield's open-source build does not include it.
AgentShield records what agents attempt. Comply records what your code declares: which models it calls, which MCP servers and skills your agents are configured with, and where AI code is wired unsafely. It maps every finding to the same threat categories and compliance controls as AgentShield, so the two show up in one place.
- Deterministic. Comply is a rule-based scanner: Semgrep with our rules, plus purpose-built checks for agent configuration. It never sends your code to a language model, and it runs with no network at all if you don't upload.
- Runs where your code is. It runs locally or in CI, from a public Docker image. Your source code is not uploaded; see what a scan uploads.
- Precise by design. A finding that is noise costs you more than one we miss, so we tune for precision.
What it finds
| Area | Examples |
|---|---|
| AI bill of materials | AI SDK imports, model references, API-key references |
| Agent configuration | MCP server configs (.mcp.json, Cursor, Claude Desktop), SKILL.md packages and their bundled scripts, plugin manifests, agent rule files (AGENTS.md, CLAUDE.md, Cursor, Cline and Copilot rules), CrewAI and LangGraph setups. 22 configuration formats in all. |
| Risky AI code | Model output reaching a shell, SQL or file path; prompt injection paths; unbounded model calls (no timeout, no token limit); conversation logs leaking; model calls that bypass your AI gateway |
| Agent supply chain | Unpinned MCP servers fetched with npx, poisoned tool descriptions in MCP servers you write, planted git hooks and binaries that hijack a command's path |
As of 2026-10-13: 5,574 rules (3,373 at ERROR severity, the ones we treat as actionable) across Python, TypeScript, JavaScript, Go, Java, C#, Ruby, Rust and configuration formats.
What a scan looks like
A five-line Python app that calls OpenAI with the user's input, plus an .mcp.json that runs a GitHub MCP server through npx, produces findings such as:
| Where | Rule | Threat category |
|---|---|---|
.mcp.json | ai-shadow-ai-mcp-npx-server | unauthorized-execution / ai-model-usage / shadow-ai-usage |
.mcp.json | ai-mcp-command-server-no-trust-zone | unauthorized-execution / agentic-attacks / mcp-cross-server-request-forgery |
app.py:3 | ai-ai-gateway-bypass-direct-sdk-python | governance-risk / ai-governance-gap / ai-gateway-bypass |
app.py:4 | ai-llm-no-token-limit-openai-python | unauthorized-execution / ai-resource-abuse / ai-denial-of-wallet |
app.py:4 | ai-governance-unpinned-api-model-alias-python | governance-risk / ai-governance-gap / ai-model-attestation-gap |
It also produced 7 more findings, all low risk for an app this small. In AI Agent Lens, each finding links to its threat category and to the controls that category maps to in each framework you have enabled.
How it fits with AgentShield
| Comply | AgentShield | |
|---|---|---|
| Question it answers | What is wired in? | What did the agent try, and what was stopped? |
| When | When code changes (CI) | Every time an agent acts |
| Where it runs | CI or a laptop | Every machine where an agent runs |
Today they connect in four concrete ways:
- One control map. Both map findings through the same versioned taxonomy, so a static finding and a runtime block land on the same controls.
- Declared vs observed MCP servers. The Posture page compares the MCP servers your repositories declare with the servers agents are seen calling, and flags the difference.
- Policy from a scan. Comply can turn what a repository declares into an AgentShield policy pack: From scan to runtime policy.
- Skill-script integrity. Comply records the hash of every script a skill bundles, and AgentShield checks it when the script runs: Skill-script integrity.
Next
- Run a scan: locally, in CI, and what gets uploaded.
- Standards, risks and languages: every language, AI framework and configuration format Comply covers.
- How AgentShield and Comply fit together.