Skip to main content

From scan to runtime policy

Preview

generate-policy and the AgentShield rules it relies on are each tested in their own product, and the flow below was run end to end on 2026-10-13. Distribution is manual for now: AI Agent Lens does not yet deliver generated packs to machines.

A repository declares what its agents may use: the MCP servers in .mcp.json, the skills in .claude/skills/, and the models in its code. generate-policy turns that declaration into an AgentShield policy pack. When an agent then calls a tool from a server nobody declared, the call is recorded as drift.

Generate the pack​

From the repository root:

mkdir -p .comply
docker run --rm --platform linux/amd64 -v "$PWD":/scan ghcr.io/ai-agentlens/comply:latest \
  generate-policy --path /scan \
  --taxonomy /usr/local/bin/taxonomy --compliance /usr/local/bin/compliance \
  --output /scan/.comply/mcp-policy.yaml --artifacts-output /scan/.comply/artifacts.yaml

For a repository whose .mcp.json declares one server, github, the pack contains:

rules:
  - id: comply-baseline-mcp-github
    match:
      tool_name_regex: ^mcp__github__
    decision: AUDIT
    reason: Declared MCP server "github" (.mcp.json) — attestation baseline traffic
  - id: comply-undeclared-mcp-server
    match:
      tool_name_regex: ^mcp__
      tool_name_not_prefix_any: [mcp__github__]
    decision: AUDIT
    reason: MCP tool call outside the declared server baseline (declared: github) — capability drift to review

Depending on what the scan finds, the pack can also contain AUDIT rules for model-invocation tools and blocked credential paths such as ~/.ssh and ~/.aws. --artifacts-output writes the skill-script integrity manifest.

Deploy it​

Copy the pack into AgentShield's MCP pack directory on the machines that work on this repository:

cp .comply/mcp-policy.yaml ~/.agentshield/mcp-packs/comply-acme-payments-api.yaml

Check it:

agentshield mcp-eval --tool mcp__slack__post_message
AUDIT
  Rules: mcp-excessive-agency-messaging-send-audit, comply-undeclared-mcp-server
  Reason: …
  Reason: MCP tool call outside the declared server baseline (declared: github) — capability drift to review

Limits​

  • The baseline matches the tool names Claude Code uses (mcp__<server>__<tool>). Calls that go through AgentShield's MCP proxy are named differently and are not matched by these rules.
  • Generated rules are AUDIT or BLOCK, never ALLOW, so a generated pack cannot weaken your other rules: the most restrictive decision still wins.
  • The pack reflects the scan it came from. When the repository adds a server, generate it again.
  • Separately, the Posture page shows declared-vs-observed MCP servers for your whole organisation without any of this. It compares the servers named in uploaded scans with the servers seen in agent activity.