security_compliance_check · Infra Ops MCP: Risk & Policy

WHAT IT DOES

What security_compliance_check does on Infra Ops

AI agents invoke security_compliance_check to trigger actions in Infra Ops. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why security_compliance_check needs a policy

This tool runs an external scanning tool (Trivy) to perform compliance checks. It is an Execute-category action because it triggers an external operation (a security/compliance scan) whose effects depend on the arguments (what targets are scanned). It is read-only in terms of data modification but involves executing a scanning process.

From the tool's definition 'Run compliance benchmarks using Trivy configuration scanning' — actively executes Trivy scanning tool against infrastructure configurations

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

security_compliance_check Rate-limited

security_compliance_check stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "security_compliance_check": {
      "limits": [
        {
          "counter": "security_compliance_check_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Infra Ops, so you can run agents against it safely.

FAQ

Questions about security_compliance_check

What does the security_compliance_check tool do? +

Run compliance benchmarks using Trivy configuration scanning. It is categorised as a Execute tool in the Infra Ops MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on security_compliance_check? +

Register the Infra Ops MCP server in PolicyLayer and add a rule for security_compliance_check: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Infra Ops. Nothing to install.

What risk level is security_compliance_check? +

security_compliance_check is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit security_compliance_check? +

Yes. Add a rate_limit block to the security_compliance_check rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block security_compliance_check completely? +

Set action: deny in the PolicyLayer policy for security_compliance_check. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides security_compliance_check? +

security_compliance_check is provided by the Infra Ops MCP server (skyvanguard/infra-ops-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.