Repository scope
Constrain the workspace and files the agent can read or write.
AI Coding Assistant Security
Control what coding assistants can run and change.
Secure the repositories, MCP tools, dependencies and release workflows used by AI coding assistants. Inspect what they trust and govern the actions they can take.
Check the tools a coding assistant can run.
A coding assistant may read a repository, run a package installer, call MCP tools and trigger release automation. Review the full path between suggested code and a changed environment.
Before the tool is trusted
Inspect MCP server code, install scripts, dependencies and tool definitions.
At the requested action
Evaluate the agent, tool, repository path and parameters at the configured boundary.
After a dependency changes
Review material schema, package or workflow changes before preserving the original approval.
A dependency update should not acquire production credentials.
An agent installs a package while completing a change. An install script or MCP response attempts to redirect it toward production secrets and an external endpoint.
Tool and credential scope
Review permitted tools and argument patterns; keep production credentials outside an ordinary coding task.
Release scope
Separate code preparation from privileged deployment actions and apply the agreed review path.
Check file access, tools and release permissions.
Review repository access, package installation and deployment as separate permissions. Confirm that the coding task does not expose credentials intended only for production.
- Repository and path constraints
- Coding agents read repositories and propose or write changes.
- Tool and parameter policy
- Release agents install packages, trigger CI/CD and change environments.
- Package and egress restrictions
- Support agents call administrative tools and customer facing APIs.
Representative workflow patterns. Controls apply at supported, configured integration points; these examples do not imply packaged industry integrations or regulatory certification.
Scope and responsibility questions.
Does discovering a coding client mean all its actions are governed?
No. Discovery identifies the configured surface. Runtime enforcement applies to actions routed through a supported proxy, gateway, hook or authenticated API. Direct paths around it must be addressed in the deployment.
Is scanning a skill instruction file enough?
The instruction file is only part of the dependency. MCP server code, packages, lockfiles, install scripts and CI workflows can affect what executes and should be included in the review.
Scope a coding-agent assessment.
Assessment: exercise the reachable path
Agree targets, conditions, evidence and remediation.
Control: apply the local action policy
Identity, tool, parameter and destination constraints.
Frameworks: connect controls to assurance
Versioned mappings with explicit coverage and limitations.