Server-side secrets
Tenant LLM API keys stay inside BlackShield's AI Gateway. The runtime only receives a short-lived access token plus tenant policy context.
Typed capabilities
Host, web, cloud, code, incident, threat-hunting, and finding-triage work uses fixed-argument runners and typed queries. Protocol v3 has no generic shell action.
Preview means no-op
Active and mutating operations always return `executed: false` in runtime 1.2.7. Operator approval cannot bypass capability policy or the release gate.
Publish reusable workflow missions
The Workflows tab builds a structured DAG with typed node inputs, an explicit entry node, and completed or needs_attention transitions. Validate and simulate target, policy, health, and context resolution before publishing.
Every published checksum and version is immutable. Editing creates one newer draft while all retained published versions remain launchable as workflow capabilities and templates in Missions.
Deployment steps
1. Step
Create an installation in the `/agents` console. BlackShield issues a dedicated bootstrap key and links a service principal to AI Gateway.
2. Step
Run the `public.ecr.aws/blackshield-security/security-agent:1.2.7` container with `BLACKSHIELD_API_URL` and `BLACKSHIELD_API_KEY`.
3. Step
Choose a structured mission, verify the installation capability and target scope, then monitor live-versus-preview decisions, evidence, quarantines, and handoffs.
Use the API URL for the runtime
Set BLACKSHIELD_API_URL to the BlackShield API origin, such as https://api.blackshield.chaplau.com. Do not point the runtime at the dashboard URL such as https://blackshield.chaplau.com.
The runtime derives fixed MCP and AI Gateway paths from that configured API origin, then verifies the MCP tool manifest before advertising readiness. It never trusts a proxy-sensitive request host.
Do not set runtime model or provider variables. AI Gateway tries up to three enabled providers in the installation allowlist and applies each integration's configured model and limits. Planner readiness is shown separately from deterministic capability readiness.
Operating limits in runtime 1.2
- Only observe capabilities and explicitly scoped safe probes execute live.
- Active and mutating operations are previews, even after approval.
- Static web credentials use short-lived, origin-bound leases and never enter model context.
- Deterministic scanner output seeds at least eight journaled investigation states with governed AI pivots.
- Every agent finding identifies its installation and mission and links directly to the originating run report.
- Host, cloud, code, and web use managed deadlines of 720, 900, 600, and 180 seconds.
- OWASP Top 10:2025 coverage is reported honestly as tested, partial, or unavailable.
Open the product
Guides default to the stable runtime tag. Use public.ecr.aws/blackshield-security/security-agent:latest only if you want the preview channel.
Troubleshooting missions
Typed missions start with their validated scanner capability, then continue through planner-guided investigation pivots before completion. Optional AI synthesis runs afterward with its own queued, running, ready, unavailable, or failed status. Governed planning is required; if its allowed provider routes are exhausted, the run preserves findings and artifacts and finishes as needs_attention.
needs_attention identifies an actionable compatibility, target-access, quarantine, or essential-planning problem. Activity shows the stable error code and recommended recovery. Installations marked “upgrade required” cannot receive new work.
To upgrade, pull the stable command again and recreate the container while preserving the agent state volume. Confirm the heartbeat shows runtime 1.2.7, protocol 3, granular host capability health, and a verified build before assigning work.
For planner_provider_unavailable, enable an integration in the installation allowlist. For planner_provider_exhausted, repair the sanitized provider configuration or credential error. For planner_schema_exhausted, upgrade the agent and simplify the mission. For planner_request_failed with HTTP 504, restore the control-plane AI Gateway's 120-second governed-routing integration before retrying. For scanner_timeout, narrow the Prowler regions or services instead of retrying the same scope. A terminal scanner_failedpreserves its structured diagnostic and stops before planning.
Host scans intentionally skip the protected /host/run/cloud-init/instance-data-sensitive.jsonfile. The generated container drops every Linux capability except DAC_OVERRIDE, uses a read-only host mount, and can therefore inspect root-owned configuration without host writes. Package and manual checks continue in separate failure domains. Health binds to 127.0.0.1:8080; pod-IP probes require an explicit 0.0.0.0 bind plus NetworkPolicy.
Archive an offline installation to revoke its bootstrap identity and cancel targeted work while preserving audit history. Archives cannot be restored; create a new installation instead. Permanent deletion is available only for never-connected placeholders with no credentials or runtime history.