Quickstart: AI security

1. Score the repo. repoops readiness gives a 0 to 100 day-one score and the top five fixes, computed from what is installed on the machine and which MCP servers are configured. It runs locally with no server, no account and no network, and it never executes an MCP server to inspect it.
2. Inventory the MCP surface. repoops mcp-scan lists what your agents can actually reach, which is usually the surprising part.
3. Arm exactly one control. Take the top fix from the readiness score and move that one detector from advisory to enforcing. One is the right number to start with, because the first thing you want to know is whether a block is survivable in your workflow.

Registering the pre-tool hook and moving a detector to enforcing are two separate actions, and both are manual. That is more friction than it should be, and a single command to arm a detector is planned rather than shipped. The upside of the current shape is that neither step can happen by accident.

Enforcement runs at the pre-tool hook of Claude Code, the Codex CLI and the Copilot CLI, plus the MCP seam. There is no network interception, on purpose.

Prompt injection is unsolved at the model layer. These controls contain blast radius: they stop a dangerous tool call at the boundary and let you kill a run. They do not stop every attack, and any page that told you otherwise would be selling you something.

A blocked call is worth attributing, so pair this with attribution to see which session tripped it and what that session cost.

Security readiness covers the score and the starter policy templates. Agent Code Security covers the scans over what your agents write.