### Install Runtime Monitor

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Installs the PreToolUse runtime monitor. This is the first step in setting up runtime monitoring for AgentShield.

```bash
# Install the PreToolUse runtime monitor
agentshield runtime install
```

--------------------------------

### Start MiniClaw with Custom Configuration

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Starts the MiniClaw agent runtime with custom network port and rate limiting configurations.

```bash
npx ecc-agentshield miniclaw start --port 4000 --network localhost --rate-limit 20
```

--------------------------------

### Install and Run AgentShield CLI

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Scan your Claude Code configuration using npx without global installation, or install globally for direct command access.

```bash
# Scan your Claude Code config (no install required)
npx ecc-agentshield scan

# Or install globally
npm install -g ecc-agentshield
agentshield scan
```

--------------------------------

### Start MiniClaw with Secure Defaults

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Starts the MiniClaw agent runtime with default secure settings, binding to localhost and restricting network access.

```bash
npx ecc-agentshield miniclaw start
```

--------------------------------

### Build and Test Commands

Source: https://github.com/affaan-m/agentshield/blob/main/CLAUDE.md

Commands for building the project, running tests, and starting in watch mode.

```bash
npm run build      # tsc + tsup → dist/
npm test           # vitest (912 tests)
npm run dev        # tsx watch mode
```

--------------------------------

### Clone Repository and Install Dependencies

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Clone the AgentShield repository, navigate into the directory, and install project dependencies using npm.

```bash
git clone https://github.com/affaan-m/agentshield.git
cd agentshield
npm install
```

--------------------------------

### List Sessions Response Example

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Shows the JSON format for the response from the GET /api/session endpoint, which returns a list of currently active sessions.

```json
{
  "sessions": [
    {
      "id": "uuid",
      "createdAt": "2026-03-13T19:42:00.000Z",
      "allowedTools": ["read", "search", "list"],
      "maxDuration": 300000
    }
  ]
}
```

--------------------------------

### Install AgentShield CLI

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Installs the AgentShield command-line interface globally for direct terminal use.

```bash
npm install -g ecc-agentshield
```

--------------------------------

### Example Enterprise Policy Configuration

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

An example JSON configuration for an enterprise policy, detailing version, name, policy pack, owners, score gates, severity limits, required denies, and exceptions.

```json
{
  "version": 1,
  "name": "Acme Corp Security Policy",
  "policy_pack": "enterprise",
  "owners": ["security-platform@acme.example"],
  "min_score": 85,
  "max_severity": "high",
  "required_deny_list": ["Bash(rm -rf"],
  "exceptions": [
    {
      "id": "AS-EX-001",
      "rule": "required_hooks",
      "owner": "security-platform@acme.example",
      "reason": "Legacy repository migration window",
      "expires_at": "2026-06-30T23:59:59.000Z",
      "scope": "agentshield",
      "ticket": "SEC-1234"
    }
  ]
}
```

--------------------------------

### Run Initial Checks and Demo Scan

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Perform a type check and run a demo scan to verify the project setup and functionality.

```bash
npm run typecheck
npm run scan:demo   # verify everything works
```

--------------------------------

### Running Specific Test Suite

Source: https://github.com/affaan-m/agentshield/blob/main/CLAUDE.md

Example of how to run a specific test suite using Vitest.

```bash
npx vitest run tests/rules/mcp.test.ts
```

--------------------------------

### agentshield miniclaw start

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Starts the MiniClaw service, which exposes an HTTP API for AgentShield functionalities.

```APIDOC
## CLI Command: agentshield miniclaw start

### Description
Starts the MiniClaw service. This service exposes an HTTP API for AgentShield functionalities via `/api/*` endpoints.

### Usage
```bash
agentshield miniclaw start
```
```

--------------------------------

### Prompt Request and Response Example

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Demonstrates the structure of a request to the POST /api/prompt endpoint and its corresponding JSON response, including session details, prompt, context, and response content.

```json
// Request
{
  "sessionId": "uuid",
  "prompt": "Read the file src/index.ts",
  "context": { "key": "optional metadata" }
}

// Response
{
  "sessionId": "uuid",
  "response": "MiniClaw fallback responder is active. No external LLM backend is configured in this runtime. Session uuid is sandboxed with 3 allowed tools: read, search, list. Sanitized prompt preview: \"Read the file src/index.ts\" ...",
  "toolCalls": [],
  "duration": 1234,
  "tokenUsage": { "input": 100, "output": 200 }
}
```

--------------------------------

### Start MiniClaw as a Library

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Initializes and starts the MiniClaw runtime programmatically within a TypeScript application.

```typescript
import { startMiniClaw } from 'ecc-agentshield/miniclaw';

const { server, stop } = startMiniClaw();
// Listening on http://localhost:3847
```

--------------------------------

### Health Check Response Example

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Provides an example of the JSON response from the GET /api/health endpoint, indicating the system's operational status and active session count.

```json
{
  "status": "ok",
  "sessions": 1
}
```

--------------------------------

### CLI Commands for Scanning and MiniClaw

Source: https://github.com/affaan-m/agentshield/blob/main/CLAUDE.md

Usage examples for the AgentShield CLI, including static analysis, adversarial pipeline, output formatting, auto-fix suggestions, and launching the MiniClaw server.

```bash
agentshield scan [path]              # Static analysis
agentshield scan --opus              # + Opus 4.6 adversarial pipeline
agentshield scan --format json|md    # Output format
agentshield scan --fix               # Show auto-fix suggestions
agentshield miniclaw start           # Launch MiniClaw secure agent server
agentshield miniclaw start --port N  # Custom port
```

--------------------------------

### Create Session Response Example

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Illustrates the JSON response structure when creating a new sandboxed session using the POST /api/session endpoint.

```json
{
  "sessionId": "uuid",
  "createdAt": "2026-03-13T19:42:00.000Z",
  "allowedTools": ["read", "search", "list"],
  "maxDuration": 300000
}
```

--------------------------------

### Registering New Rules

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Example of how to register newly defined rules within the main rules index file.

```typescript
import { myRules } from "./my-rules.js";

export function getBuiltinRules(): ReadonlyArray<Rule> {
  return [
    ...secretRules,
    ...permissionRules,
    ...hookRules,
    ...mcpRules,
    ...agentRules,
    ...myRules,       // add here
  ];
}
```

--------------------------------

### Oversized Prompt Detection - False Positive Examples

Source: https://github.com/affaan-m/agentshield/blob/main/false-positive-audit.md

Shows how large fenced examples, output templates, and markdown tables were incorrectly included in prompt size calculations. The fix discounts these elements for a more accurate effective prompt size.

```markdown
What still flags, correctly:
- `agents/architect.md` still flags at `5514 effective characters (6291 raw)`
- `agents/code-reviewer.md` still flags at `6296 effective characters (8747 raw)`
- `agents/kotlin-reviewer.md` still flags at `5223 effective characters (6612 raw)`
```

--------------------------------

### AgentShield Security Report Example

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Example of a security report generated by AgentShield, showing a grade, score breakdown, critical findings with evidence and fixes, and a summary of scanned files and findings.

```text
  AgentShield Security Report

  Grade: F (0/100)

  Score Breakdown
  Secrets        ░░░░░░░░░░░░░░░░░░░░ 0
  Permissions    ░░░░░░░░░░░░░░░░░░░░ 0
  Hooks          ░░░░░░░░░░░░░░░░░░░░ 0
  MCP Servers    ░░░░░░░░░░░░░░░░░░░░ 0
  Agents         ░░░░░░░░░░░░░░░░░░░░ 0

  ● CRITICAL  Hardcoded Anthropic API key
    CLAUDE.md:13
    Evidence: sk-ant-a...cdef
    Fix: Replace with environment variable reference [auto-fixable]

  ● CRITICAL  Overly permissive allow rule: Bash(*)
    settings.json
    Evidence: Bash(*)
    Fix: Restrict to specific commands: Bash(git *), Bash(npm *), Bash(node *)

  Summary
  Files scanned: 6
  Findings: 73 total — 19 critical, 29 high, 15 medium, 4 low, 6 info
  Auto-fixable: 8 (use --fix)
```

--------------------------------

### AgentShield Development Commands

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Common commands for developing AgentShield, including installing dependencies, running in development mode, testing, and building.

```bash
npm install          # Install dependencies
npm run dev          # Development mode
npm test             # Run tests
npm run test:coverage # Coverage report
npm run typecheck    # Type check
npm run build        # Build
npm run scan:demo    # Demo scan against vulnerable examples
```

--------------------------------

### Shell Hook Implementation Example

Source: https://github.com/affaan-m/agentshield/blob/main/false-positive-audit.md

Shell hook implementations are processed through existing hook rules. This example shows a shell script that parses stdin JSON and writes observations.

```bash
#!/bin/bash

# Parse stdin JSON
read -r json_data

# Inspect agent_id
agent_id=$(echo "$json_data" | jq -r '.agent_id')

# Source shared scripts
source /path/to/shared/scripts.sh

# Write observations
echo "Observation for agent: $agent_id" >> ~/.claude/homunculus/observations.log
```

--------------------------------

### Primary AgentShield CLI Commands

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Basic commands for scanning, initialization, and starting miniclaw. These are the entry points for most AgentShield operations.

```bash
agentshield scan [options]
agentshield init
agentshield miniclaw start [options]
```

--------------------------------

### Scan Repository and Output JSON Report

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Initiates a scan of a specified repository path and outputs the results in JSON format to a report file. This is the starting point for detailed analysis.

```bash
agentshield scan --path /repo --format json > report.json
```

--------------------------------

### Get session info

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Retrieves information about an existing sandboxed session.

```APIDOC
## GET /api/session

### Description
Retrieves information about the current or a specified sandboxed session.

### Method
GET

### Endpoint
/api/session

### Parameters
#### Query Parameters
- **sessionId** (string) - Optional - The ID of the session to retrieve information for. If omitted, information about the default or active session might be returned.
```

--------------------------------

### Write Baseline JSON File

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Examples for writing a baseline JSON file using the `agentshield baseline write` command. Specify the path to scan and the output file path. The `--json` flag can be used for JSON output format.

```bash
agentshield baseline write --path .claude --output .github/agentshield-baseline.json
```

```bash
agentshield baseline write --path .claude --output baseline.json --json
```

--------------------------------

### Explorer/Search Write Detection - False Positive Examples

Source: https://github.com/affaan-m/agentshield/blob/main/false-positive-audit.md

Illustrates how generic text in commands or workflow steps was misinterpreted as explorer/search agent metadata, leading to false positives. The fix narrows the heuristic to stronger role signals.

```markdown
| File | Old trigger text | New interpretation |
| --- | --- | --- |
| `agents/chief-of-staff.md` | ``gog gmail search "is:unread" --json`` | command example only, not explorer role metadata |
| `agents/security-reviewer.md` | `Search for hardcoded secrets` | review workflow step, not an explorer/read-only agent |
| `.claude/slash-commands/test-coverage.json` | `Search coverage gaps and write tests` | procedural task description, not search-only role metadata |
```

--------------------------------

### Inspect Multiple Evidence Packs (Fleet)

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Inspect multiple evidence packs to get aggregated results and routing suggestions. The --json flag ensures parseable output.

```bash
agentshield evidence-pack fleet ./repo-a-evidence ./repo-b-evidence --json
```

--------------------------------

### MiniClaw Package API

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

The MiniClaw package provides a stable programmatic API for AgentShield. It includes functions for starting the HTTP server, creating sandbox sessions, routing prompts, and building policy sets.

```APIDOC
## MiniClaw Package API

### Description
Provides a stable programmatic API for AgentShield.

### Entrypoints
- `startMiniClaw(config?)`: Starts the MiniClaw HTTP server with secure defaults.
- `createMiniClawSession(config?)`: Creates an isolated sandbox session for embedding MiniClaw into an existing application.
- `routePrompt(request, session)`: Sanitizes and processes a prompt against a session.
- `createSafeWhitelist()`: Builds a tool policy set for safe whitelisting.
- `createGuardedWhitelist()`: Builds a tool policy set for guarded whitelisting.
- `createCustomWhitelist()`: Builds a tool policy set for custom whitelisting.
- `createMiniClawServer(config)`: Creates a server handle without the convenience wrapper.

### Core Types
- `PromptRequest`
- `PromptResponse`
- `MiniClawSession`
- `MiniClawConfig`
- `SandboxConfig`
- `SecurityEvent`
```

--------------------------------

### Write Baseline Snapshot

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Create a baseline snapshot of your project. Add the --json flag to emit parseable metadata.

```bash
agentshield baseline write --path .claude --output .github/agentshield-baseline.json
```

--------------------------------

### AgentShield Policy Initialization

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Commands to initialize new policy packs with specified owners and names, or to export existing policy packs to a directory.

```bash
agentshield policy init --pack enterprise --owner security@example.com
agentshield policy init --pack regulated --name "Regulated Agent Policy"
```

```bash
agentshield policy export --pack ci-enforcement --output-dir .github/agentshield-policies
```

--------------------------------

### AgentShield Advanced Commands

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Demonstrates various command-line options for AgentShield, including scanning specific paths, auto-fixing issues, changing output formats, generating reports, creating evidence packs, running adversarial analysis, and initializing a secure baseline config.

```bash
# Scan a specific directory
agentshield scan --path /path/to/.claude

# Auto-fix safe issues (replaces hardcoded secrets with env var references)
agentshield scan --fix

# JSON output for CI pipelines
agentshield scan --format json

# Generate an HTML executive security report
agentshield scan --format html > report.html

# Generate a portable audit bundle
agentshield scan --evidence-pack ./agentshield-evidence

# Three-agent Opus 4.6 adversarial analysis (requires ANTHROPIC_API_KEY)
agentshield scan --opus --stream

# Generate a secure baseline config
agentshield init
```

--------------------------------

### agentshield init

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Initializes AgentShield, likely setting up configuration or project structure.

```APIDOC
## CLI Command: agentshield init

### Description
Initializes AgentShield. This command is typically used to set up a new project or configuration for AgentShield.

### Usage
```bash
agentshield init
```
```

--------------------------------

### GET /api/session

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Retrieves a list of all currently active sessions.

```APIDOC
## GET /api/session

### Description
Returns a list of all currently active sessions managed by the service.

### Method
GET

### Endpoint
/api/session

### Response
#### Success Response (200)
- **sessions** (array) - An array of session objects.
  - **id** (string) - The unique identifier for the session.
  - **createdAt** (string) - The timestamp when the session was created.
  - **allowedTools** (array) - A list of tools permitted within this session.
  - **maxDuration** (integer) - The maximum allowed duration for the session in milliseconds.

#### Response Example
```json
{
  "sessions": [
    {
      "id": "uuid",
      "createdAt": "2026-03-13T19:42:00.000Z",
      "allowedTools": ["read", "search", "list"],
      "maxDuration": 300000
    }
  ]
}
```
```

--------------------------------

### AgentShield CLI Scan Options

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Provides a comprehensive list of options for scanning configuration directories. Use the `--path` option to specify the directory and `--format` to control output type. Other options enable advanced analysis like Opus, prompt injection testing, and taint analysis.

```bash
agentshield scan [options]         Scan configuration directory
  -p, --path <path>                Path to scan (default: ~/.claude or cwd)
  -f, --format <format>            Output: terminal, json, markdown, html, sarif
  -o, --output <path>              Write the primary report output to a file
  --fix                            Auto-apply safe fixes
  --opus                           Enable Opus 4.6 multi-agent analysis
  --stream                         Stream Opus analysis in real-time
  --injection                      Run active prompt injection testing
  --sandbox                        Execute hooks in a sandbox and observe behavior
  --taint                          Run taint analysis (data flow tracking)
  --deep                           Run injection + sandbox + taint + opus together
  --log <path>                     Write structured scan logs to a file
  --log-format <format>            Log format: ndjson or json
  --corpus                         Run built-in attack corpus benchmark
  --corpus-gate                    Fail if the built-in attack corpus regresses
  --baseline <path>                Compare against a baseline file
  --save-baseline <path>           Save current scan results as a baseline file
  --gate                           Fail on new critical/high findings or score drop
  --supply-chain                   Verify MCP package provenance and risk
  --supply-chain-online            Include npm registry metadata
  --policy <path>                  Validate against an organization policy
  --evidence-pack <dir>            Write portable evidence bundle
  --remediation-plan <path>        Write stable-fingerprint JSON remediation plan
  --no-evidence-redact             Disable evidence-pack redaction
  --min-severity <severity>        Filter: critical, high, medium, low, info
  -v, --verbose                    Show detailed output
```

--------------------------------

### GET /api/health

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Provides a basic health status of the MiniClaw service.

```APIDOC
## GET /api/health

### Description
Returns a basic health payload indicating the status of the service and active sessions.

### Method
GET

### Endpoint
/api/health

### Response
#### Success Response (200)
- **status** (string) - The health status of the service (e.g., "ok").
- **sessions** (integer) - The number of currently active sessions.

#### Response Example
```json
{
  "status": "ok",
  "sessions": 1
}
```
```

--------------------------------

### GET /api/events/:sessionId

Source: https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/README.md

Retrieves the security event log for a specific session.

```APIDOC
## GET /api/events/:sessionId

### Description
Returns the security event log associated with a particular session.

### Method
GET

### Endpoint
/api/events/:sessionId

### Parameters
#### Path Parameters
- **sessionId** (string) - Required - The unique identifier of the session for which to retrieve events.
```

--------------------------------

### Run Tests

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Execute the project's test suite, including tests with code coverage.

```bash
npm run test                                       # run tests
npm run test:coverage                          # tests with coverage
```

--------------------------------

### Get security audit events

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Retrieves security audit events for a given session.

```APIDOC
## GET /api/events/:sessionId

### Description
Fetches security audit events associated with a specific session, useful for monitoring and debugging.

### Method
GET

### Endpoint
/api/events/:sessionId

### Parameters
#### Path Parameters
- **sessionId** (string) - Required - The ID of the session for which to retrieve events.
```

--------------------------------

### Secure Init: Generate Hardened Directory

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Generates a hardened `.claude/` directory with scoped permissions, safety hooks, and security best practices. Existing files are never overwritten.

```bash
agentshield init
```

--------------------------------

### Initialize Enterprise Policy Pack

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Initializes a new policy pack for enterprise use, specifying the owner. This command sets up the basic structure for an enterprise-level policy.

```bash
agentshield policy init --pack enterprise --owner security-platform@acme.example
```

--------------------------------

### AgentShield CLI Other Commands

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Lists other available AgentShield CLI commands for initialization, baseline management, evidence pack operations, policy management, and runtime monitoring.

```bash
agentshield init                   Generate secure baseline config
agentshield baseline write         Write a scan baseline JSON file
agentshield evidence-pack fleet    Summarize multiple evidence packs for routing
agentshield evidence-pack inspect  Verify and summarize an evidence bundle
agentshield evidence-pack verify   Verify artifact and bundle digests
agentshield policy export          Export policy packs plus checksum manifest
agentshield policy init            Generate an organization policy preset
agentshield policy promote         Verify and promote an exported policy
```

--------------------------------

### Initialize Regulated Policy Pack

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Initializes a new policy pack for regulated environments, allowing for a custom name. This is useful for specific compliance requirements.

```bash
agentshield policy init --pack regulated --name "Acme Regulated Policy"
```

--------------------------------

### Promote Policy with Manifest

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Promotes a policy by verifying its manifest and writing the active policy. This command is used in review workflows before applying policies.

```bash
agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --output .agentshield/policy.json
```

--------------------------------

### Inspect Evidence Pack

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Inspect an evidence pack to get detailed scan results and metadata. The --json flag provides parseable output.

```bash
agentshield evidence-pack inspect ./agentshield-evidence --json
```

--------------------------------

### Build and Type Check Project

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Build the project using tsup and perform a type check to ensure code quality.

```bash
npm run build                                  # build with tsup
npm run typecheck                              # type check
```

--------------------------------

### Filter for Lower-Confidence Inventory Findings

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Extracts lower-confidence findings that typically require interpretation rather than immediate suppression. This includes findings from templates, examples, documentation, and plugin manifests.

```bash
jq '.findings
  | map(select((.runtimeConfidence // "") | IN("template-example","docs-example","plugin-cache","plugin-manifest")))
  | map({file, severity, runtimeConfidence, title})' report.json
```

--------------------------------

### Compare Scan with Baseline

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Demonstrates how to compare a current scan against a saved baseline using the `--baseline` and `--gate` options. This is useful for CI/CD pipelines to detect regressions.

```bash
agentshield scan --baseline .github/agentshield-baseline.json --gate
```

--------------------------------

### Check Runtime Monitor Status

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Checks the health of the runtime monitor, including the hook, policy, and log path. Use this command to ensure the runtime monitoring setup is functioning correctly.

```bash
# Check whether the hook, policy, and log path are healthy
agentshield runtime status --check
```

--------------------------------

### Additional Responses - Events

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

This JSON object shows an example of additional responses, specifically for security events associated with a session. It includes an array of event objects with type, details, timestamp, and session ID.

```json
{
  "sessionId": "uuid",
  "events": [
    {
      "type": "prompt_injection_detected",
      "details": "Removed hidden instruction",
      "timestamp": "2026-03-13T19:42:01.000Z",
      "sessionId": "uuid"
    }
  ]
}
```

--------------------------------

### Structured Slash Commands with Allowed Tools

Source: https://github.com/affaan-m/agentshield/blob/main/false-positive-audit.md

Previously, JSON files in .claude/slash-commands/ were treated as skill-md, producing no findings despite explicit allowedTools. Now, these are recognized as agent-like tool configurations, leading to accurate findings.

```json
{
  "tools": [
    {
      "tool_name": "Bash",
      "description": "Execute bash commands."
    },
    {
      "tool_name": "Write",
      "description": "Write to files."
    },
    {
      "tool_name": "Edit",
      "description": "Edit files."
    },
    {
      "tool_name": "Glob",
      "description": "Glob files."
    },
    {
      "tool_name": "Grep",
      "description": "Grep files."
    }
  ]
}
```

--------------------------------

### Export Policies as JSON with Name Prefix

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Exports policies in JSON format, applying a name prefix to the output files. This helps in organizing exported policies.

```bash
agentshield policy export --pack ci-enforcement --name-prefix "Acme" --json
```

--------------------------------

### Dry Run Policy Promotion with JSON Output

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Performs a dry run of policy promotion, outputting the plan in JSON format. This allows verification of the promotion details without applying changes.

```bash
agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --dry-run --json
```

--------------------------------

### AgentShield Policy Promotion

Source: https://github.com/affaan-m/agentshield/blob/main/API.md

Commands to promote policy files, either for direct use or as a dry run to check for potential issues before applying.

```bash
agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --output .agentshield/policy.json
```

```bash
agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --dry-run --json
```

--------------------------------

### Broader Example-Root Classification

Source: https://github.com/affaan-m/agentshield/blob/main/false-positive-audit.md

Desired behavior for broader example-root classification is to keep obvious tutorials/examples downgraded and labeled without misclassifying real runtime config.

```json
{
  "settings": {
    "model": "claude-3-opus-20240229",
    "temperature": 0.7
  }
}
```

--------------------------------

### Development Mode Scanner

Source: https://github.com/affaan-m/agentshield/blob/main/CONTRIBUTING.md

Run the scanner in development mode, specifying a path to scan.

```bash
npm run dev scan --path examples/vulnerable   # run scanner in dev mode
```

--------------------------------

### Export Policies to Directory

Source: https://github.com/affaan-m/agentshield/blob/main/README.md

Exports all configured policies to a specified directory, including a manifest file. This is useful for version control and auditing.

```bash
agentshield policy export --output-dir .github/agentshield-policies --owner security-platform@acme.example
```