.svg)
Security context, in the editor you're already in.
Over the Model Context Protocol, your coding agent pulls live data straight from Heeler — SAST findings, dependency vulnerabilities, endpoint exposure, deployment risk, package intelligence, guardrail status and SLO pressure — and reasons about real risk as it writes the code. In Cursor, Windsurf, Zed and compatible VS Code extensions, Heeler receives your current file and repository automatically, so "check findings for the file I'm on" simply works.
Security during code generation — not after.
The volume of AI-generated code has destroyed the assumption that a human reviewer will catch security mistakes. The gap between what agents produce and what teams can review, triage, and remediate widens every sprint. The economics shifted; the playbook hasn't.
Agents don't know your policies
Coding agents make decisions about dependencies, secrets, and patterns with no view of your org's rules, threat model, or runtime exposure.
Reviewers can't keep up
By the time scanner output reaches a human, the agent has generated five more PRs. Volume defeats triage; the backlog wins.
Legacy tools fire too late
Linters and SAST run when the agent is gone. Findings become tickets. Tickets become backlog. Nothing was prevented.
Three places Heeler shows up inside the agent.
Heeler treats coding agents as first-class consumers of your security context — the same graph a PR guardrail reads, the agent reads too.
Heeler MCP server
A single Model Context Protocol endpoint exposing 38 tools across 13 context groups — findings and triage, code security, dependencies, CVE blast radius, package intelligence, endpoints and exposure, runtime and deployment, service and portfolio posture, remediation planning, guardrails and SLOs, agent-file governance, reporting and export, and documentation search. Almost all read-only: the agent observes, it doesn't change your platform.
- Tool calls including get_vulnerabilities_for_project, get_sast_results_for_file, guardrail_list, service_risk_brief
- Compatible with any MCP-supporting agent
- Org context, threat data, and runtime exposure included in every response
Heeler Agent Skills
Eight drop-in skills the agent discovers on its own, each wrapping a heelercli command — secrets, vulnerabilities, licenses, malicious packages, safest version, and a full security review. Where the MCP server gives the agent context to read, skills give it checks to run.
- Skills cover dependency upgrades, secret handling, malicious-package detection, and remediation flows
- Org-specific overrides for approved packages and forbidden patterns
- Updated continuously as policies and threats change
Heeler CLI
Local and CI-side checks that run the same logic as the MCP server. Developers and agents can run heeler check before committing — catching what review would have caught, before review starts. Offline secret detection is built in.
- Pre-commit checks for SCA, secrets, and malicious packages
- Same policy as CI and the platform
- Runs offline; source code never leaves the machine for secret detection
PROMPTS AND ACCESS
Four prompts, so every developer runs the same pass.
Beyond tools, the server ships named prompts — repeatable, structured security reviews invoked by name, so a review doesn't depend on how well the person phrased it. Use the exact name; paraphrases may not resolve.
secure_development_checklist
A pre-commit secure-development pass over the code in hand.
secure_code_risk_review
A focused risk review of a change — what could go wrong, and what to verify before it ships.
heeler_sast_pass
A SAST-oriented review that pulls and reasons over code-security findings.
heeler_sca_dependency_guard
A dependency check that surfaces and triages vulnerable packages.
Read by default, write behind admin
Two read scopes unlock the everyday experience. SLO overrides and triggering agentic remediation each need an additional scope and an admin role — a read-only connection cannot use them at all.
Any SCM, the same question
Tools take a repository URL and resolve it across GitHub, GitLab, Bitbucket and Azure DevOps — provider-aware, so the same ask works whatever you're on.
HEELER IN SLACK
Not in an editor? Ask in Slack.
The same live Heeler context and the same assistant are available in Slack — mention Heeler in a channel and ask. No MCP client, no editor, nothing for the person asking to install.
Nothing to configure
Mention Heeler in a channel and ask the question. No client setup and no per-person connection — which matters for the people who need answers but never open an editor.
The same graph, the same answer
Slack reads the same correlated model of your environment that the MCP server and your PR guardrails read, so an answer in a channel matches the answer in the editor. No second version of the truth.
Where the conversation already is
Posture questions, service risk briefs and finding lookups land in the thread that's already arguing about them, rather than in a dashboard nobody has open.
One security posture across every agent your developers use.
Anyone can tell an agent to 'be secure.' That's a prompt, not a program — it varies by developer, model, and day. Heeler makes posture consistent and repeatable: one central policy, defined once by security and applied identically across every agent below, then enforced again at the PR as an auditable guardrail check. Not re-invented per tool, per model, per person.
RELATED · AGENT SKILLS SECURITY
The agent skills themselves are an attack surface.
A different job from everything above. The MCP server, Skills, and CLI put Heeler's security context inside your coding agents — Agent Skills Security does the reverse, inspecting the instruction and skill files those agents load (CLAUDE.md, AGENTS.md, SKILL.md, .cursorrules, mcp.json) for prompt injection and malicious behavior before they reach your developers. It's a separate capability, with its own page.
Safety score per file
Every agent file gets a 0–100 safety score — higher is safer — and anything below 70 is flagged At Risk.
Benign · suspicious · malicious
Deterministic static analysis, an LLM judge, and external-reference reputation combine into a verdict you can act on.
Attack categories
Eleven categories — prompt injection, data exfiltration, remote code execution, privilege escalation, secrets exposure, deception, and more.
One policy. Every layer of prevention.
Heeler runs the same policy everywhere your code moves, read from one model of your environment in the Context Engine. Agent Skills and the MCP server are the layer inside the coding agent — they don't replace the others, they share their policy and their findings.
MCP Server & Agent Skills
Inside the AI coding agent, as code is generated.
In the terminal, before commit.
Native status checks on the pull request, server-side.
Routing, tickets, and fixes after merge.
See it run on your repos.
A demo on your own codebase shows what Heeler would have caught — and prevented — in your last week of AI-generated PRs.
