Agent identity · Least privilege · MCP security
Control what AI agents can access—and what they can do.
ShellFrame keeps credentials outside model context, evaluates sensitive requests against policy, routes exceptions for approval, and preserves the decision trail.
REQUEST agent=coding-agent-07 destination=unknown.example env=prod
DECISION DENY · destination is not approved
NEXT STEP request human approval with action context
AUDIT actor, intent, policy, resource and outcome recorded
No raw secretin model context
Per requestpolicy decision
Traceableagent or human action
Built around the controls security teams are standardizing now
OWASP MCP01Token and secret exposure
OWASP MCP07Authentication and authorization
NIST directionIdentity, delegation and audit
Free open-source security check
See what your AI coding agent can reach.
Run AgentSecure on an existing repository. It reports agent-visible secret files, risky MCP configuration, dangerous scripts, and production-looking network targets—without uploading your code, credentials, or telemetry.
Recommended · run once
uvx
uvx agentsecure scan .
Fallback · install with Python
pip
python3 -m pip install --upgrade agentsecure
python3 -m agentsecure scan .
61
Agent safety score
Example report for an existing application repository
Found something risky?
Next: agentsecure start →
The control layer
Deterministic controls for non-deterministic agents.
Repository scanning reveals the risk. Secret isolation proves the enforcement point. Identity, policy, approval, and audit turn that point into an enterprise control layer.
Know who is acting
Bind actions to a named agent, its owner, the user it represents, and the environment where it runs.
AGENT + HUMAN CONTEXTRight-size every request
Evaluate destination, resource, action, and runtime context before protected access is granted.
PER-REQUEST POLICYKeep humans on risky paths
Turn a denied production action into a structured request with a clear reason and safe next step.
HUMAN IN THE LOOPPreserve the decision chain
Record who requested what, which policy ran, who approved it, and which resource was touched.
INVESTIGATION READYRecognizable attack paths
Show the risk before explaining the architecture.
Each situation makes the security boundary visible to a developer, platform engineer, or CISO.
A coding agent reads configuration
The project contains aliases. Real credentials remain in the local vault and never become prompt material.
An MCP tool asks for a token
The request is evaluated against the agent and approved destination before a credential can be used.
An agent reaches production
High-risk access is denied or escalated with the actor, intended action, target resource, and reason.
One agent delegates to another
The task may move, but authority does not silently travel with it. Each agent gets scoped access.
Architecture
One enforcement point between agents and sensitive systems.
AUDIT RAIL — actor · user · intent · policy · approval · resource · outcome
Security evidence
Inspect the security behavior, not another row of claims.
ShellFrame should be evaluated through working controls, an open implementation, and explicit boundaries.
01
Attack-path demo
See credential exfiltration denied, approved, or escalated with a clear decision trail.
RUN DEMO → 02Public security boundary
Review the local architecture, security reporting process, and documented limitations.
READ SECURITY.md → 03Security receipts
Inspect reproducible evidence for masking, policy enforcement, and local-only behavior.
VIEW RECEIPTS → 04Early access
Tell us about your agent workflow and evaluate ShellFrame with your team’s real security requirements.
REQUEST ACCESS →Expansion vision · Agent Mesh
From protecting one agent to governing teams of agents.
The working secret-protection layer proves the enforcement model. The expansion is identity-aware delegation, cross-team approvals, and a complete multi-agent decision chain.
About us
We build security infrastructure as one coordinated system.
ShellFrame combines living repository context, specialist agent research, plan-first technical design, coordinated implementation, and full-system E2E testing. We publish only after the complete feature—not just an individual repository—passes.
See how we build →Research every affected repository, then define one PRD and technical design.
Give each repo agent a scoped task and coordinate the work under one feature name.
Build the full environment, run E2E, and loop on failures until the release passes.
Start with evidence from your own repository
Find the risk locally. Then put protection in the agent’s path.
The community scanner is free, open source, and local-only. Security teams can then evaluate the broader identity, policy, approval, and audit architecture.