Secondary community artifact

Run a local preflight check before approving AI agents in a repo.

Scout is kept as a secondary community artifact. The current Orisan flagship is mcpscan for local MCP server review.

Local by default. No source upload. No cloud upload. Deterministic checks.

local proof

curl -fsSL https://orisan.org/install | sh
orisan scout

Approval guidance: Review required
READ      broad repo context
EXECUTE   shell tool available
CHANGE    auto-commit instruction found

Payload stored: false
Source upload: none

Run it today

One local command prints the terminal summary.

Install

curl -fsSL https://orisan.org/install | sh

Run

orisan scout --repo .

Reports

Add --markdown and --json when files are needed

Full runbook Sample report Advanced release assets Source repo

Report preview

The report is built for the approval thread.

terminal + orisan-scout-review.md

$ orisan scout --repo . --markdown orisan-scout-review.md --json orisan-scout-review.json

AI coding agents configured in this repo can read broad repository context and execute shell commands through MCP. Review required before approving AI agent use.

Orisan Scout completed: 3 findings (critical: 0, high: 2, medium: 1, low: 0, info: 0)
Reports written: orisan-scout-review.md, orisan-scout-review.json

## Capability Summary

AI coding agents configured in this repo can read broad repository context and execute shell commands through MCP.

## Approval Guidance

Recommended decision: Review required before approving AI coding agent use in this repository.

## Findings

HIGH   .mcp.json   filesystem server mounted to repo root
HIGH   .mcp.json   shell tool available to agent
MED    AGENTS.md   auto-commit behavior allowed

What it checks

Scout checks repo-local agent surfaces only.

.mcp.json.cursor/mcp.json.vscode/mcp.jsonAGENTS.mdCLAUDE.md.github/copilot-instructions.md.cursor/rules.windsurf/.codex/.continue/

Review questions

Scout turns repo-local agent exposure into questions a reviewer can answer.

What local tools can the agent reach from this repo?

Can the agent execute shell commands or package scripts?

Do repo instructions permit autonomous commits or pushes?

Is production, infrastructure, or credential handling mentioned in agent guidance?

What decision should AppSec make before approval?

What evidence should be kept with the approval record?

Who it helps

Kept for teams reviewing the earlier approval-artifact experiment.

AppSec

Create a repeatable preflight check before approving AI-agent use in sensitive repositories.

Engineering leads

Understand whether local agent setup has crossed from assistive coding into execution or change authority.

Security teams

Review a historical local approval-artifact experiment without treating it as the current Orisan focus.

Non-goals

Narrow on purpose, honest by default.

not a full SAST, SCA, DAST, or secrets scanner

not a cloud service

not a background agent or daemon

not a claim that every AI risk is covered

not home/global config scanning by default

not a replacement for human approval

Alpha status

Scout is not the current Orisan focus.

Current Orisan positioning leads with mcpscan. Scout remains available for context on repo-local agent approval experiments, but it should not be treated as the main product.

Feedback tracker Runbook