BLACKSHIELD

Agentic AI

Security Agent Runtime

Run governed blue-team automation inside your environment with tenant-scoped MCP context, tenant-owned AI provider configuration, and approval gates around every mutation.

Server-side secrets

Tenant LLM API keys stay inside BlackShield's AI Gateway. The runtime only receives a short-lived access token plus tenant policy context.

Read-first planning

The agent starts with findings, dashboards, remediation policy, and security-review context through MCP before it attempts any local or platform-side action.

Approval gates

Mutating shell commands and assignment-scoped product changes require explicit approval in the `/agents` console before the run can continue.

Deployment steps

1. Step

Create an installation in the `/agents` console. BlackShield issues a dedicated bootstrap key and links a service principal to AI Gateway.

2. Step

Run the `public.ecr.aws/blackshield-security/security-agent:1.0.0` container with `BLACKSHIELD_API_URL` and `BLACKSHIELD_API_KEY`.

3. Step

Queue an assignment for `finding_triage`, `remediation_followup`, or `security_review_support` and monitor the run timeline, artifacts, and approval queue.

Use the API URL for the runtime

Set BLACKSHIELD_API_URL to the BlackShield API origin, such as https://api.blackshield.chaplau.com. Do not point the runtime at the dashboard URL such as https://blackshield.chaplau.com.

The runtime bootstraps from that API origin and receives tenant-scoped MCP and AI Gateway URLs from the control plane automatically.

Operating limits in v1

  • Blue-team first. Red-team remains platform-gated and tenant-gated.
  • No tenant provider secret is exposed to the runtime.
  • No autonomous mutation mode is exposed by default.
  • All MCP tools remain read-only in v1.
Security Agent Runtime