Security Engine

Secret scanning and secure deploy cues via security_enforce.

What you will learn

• security_get
• security_plan
• security_enforce

Prerequisites

• Mount PluginHost and merge MCP tools

Surface

What this feature does

Security Engine scans for secrets and enforces secure deployment constraints. Blocks commits/publishes when findings remain.

How to call it

Call these MCP tools through your AGS / tower-gov host — security_get, security_validate, security_enforce, security_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

1. security_get
2. security_plan
3. Apply remediation
4. security_enforce

{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "security_get",
  "arguments": {}
}

What success looks like

security_enforce ok

Policy matches live state

Common failure modes

Config enabled but requiredFiles missing

Enforce without validate

Plan ignored

Related reference

• Licensing
• Architecture