What it does
Stops a change that opens a hole. Reviews a parsed Terraform/Helm plan you supply for resources it would expose to the internet and for IAM grants broader than the workload needs, and reviews a security-audit report you supply for upgrade risk. Returns a merge verdict, a ready-to-post PR comment, one single-package upgrade PR per vulnerable package, and the rule table behind every number. Provided-data: it reads your tool call and nothing else.
Example prompts
- Here are the resource changes from my terraform plan — does anything in this PR get exposed to the internet?
- Check these IAM policy changes for grants that are broader than the workload needs.
- This is my npm audit output. Which packages need a major-version jump, and which have no published fix?
