Run BlackShield's governed Go security agent inside your environment with tenant-scoped assignments, MCP context, AI Gateway controls, and approval gates around every mutation. الجمهور: Security engineers, platform engineers, and security operations teams. وقت الإعداد المعتاد: 5 minutes.
Run BlackShield's governed Go security agent inside your environment with tenant-scoped assignments, MCP context, AI Gateway controls, and approval gates around every mutation.
انسخ إعداد البداية وقم بتشغيله في بيئتك، ثم عد إلى هنا للحصول على تفاصيل التوزيع الأكثر عمقًا.
Demonstration only
This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.
Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.
Creates `deploy/security-agent/` with a Compose file, a ready-to-edit `.env.security-agent`, and a clean example copy so the agent can bootstrap with the documented runtime settings.
BLACKSHIELD_SECURITY_AGENT_IMAGE=public.ecr.aws/blackshield-security/security-agent:1.2.7 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/security-agent-docker.sh)
cd deploy/security-agent# Bootstrap the local runtime bundle first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/security-agent-docker.sh)
# Edit deploy/security-agent/.env.security-agent and replace BLACKSHIELD_API_KEY
cd deploy/security-agent
docker compose -f docker-compose.security-agent.yml up -d
docker compose -f docker-compose.security-agent.yml logs -fSECURITY_AGENT_IMAGE=public.ecr.aws/blackshield-security/security-agent:1.2.7
SECURITY_AGENT_HEALTH_PORT="$(docker run --rm --network host --entrypoint python "$SECURITY_AGENT_IMAGE" -c "import socket; s=socket.socket(); s.bind(('127.0.0.1',0)); print(s.getsockname()[1]); s.close()")" && \
docker run -d --name blackshield-security-agent --restart unless-stopped \
--network host --read-only --user 0:0 --cap-drop ALL --cap-add DAC_OVERRIDE --security-opt no-new-privileges \
--health-cmd='python -c "import os,urllib.request,sys; p=os.environ[\"SECURITY_AGENT_HEALTH_PORT\"]; r=urllib.request.urlopen(f\"http://127.0.0.1:{p}/health\",timeout=3); sys.exit(0 if r.status==200 else 1)"' \
--tmpfs /tmp:rw,noexec,nosuid,size=256m \
-e BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
-e BLACKSHIELD_API_KEY=sagent_xxxx \
-e SECURITY_AGENT_MAX_STEPS=8 \
-e SECURITY_AGENT_HEALTH_HOST=127.0.0.1 \
-e SECURITY_AGENT_HEALTH_PORT="$SECURITY_AGENT_HEALTH_PORT" \
-e SECURITY_AGENT_MAX_CAPABILITY_TIMEOUT_SECONDS=1800 \
-v /:/host:ro \
-v blackshield-agent-state:/var/lib/blackshield-agent \
"$SECURITY_AGENT_IMAGE"{
"assignment_type": "security_review_support",
"title": "Review internet-facing payment service",
"instructions": "Summarize open control gaps and propose review answers with evidence.",
"scope": {
"review_id": "2c79f0df-42b8-4d7f-9d28-7a7f4c5d6b01"
}
}استخدم الخطوات الإرشادية أدناه عندما ترغب في تخصيص التوزيع أو التحقق من الملكية أو توسيع النشر بأمان.
الخطوة 1
Use the Agents console so the runtime gets a dedicated installation identity instead of reusing a human API key.
معايير النجاح
Confirm AI Gateway already has at least one approved provider connection for the tenant.
الخطوة 2
Use the Docker Compose bundle for the fastest start, then mount only the local paths and executables the agent actually needs.
معايير النجاح
Confirm `/agents` reports the expected `host_assessment` and `web_assessment` capabilities before queueing work.
الخطوة 3
Start with read-first work such as finding triage, remediation follow-up, or security review support, then approve only the actions you want executed.
معايير النجاح
Download the final report and fold it into your incident, remediation, or review workflow.
Keep your rollout moving with the next recommended step.
مراجعة النتائج وتحديد الأولويات