compliance-scanner

Compliance Scanner Agent

Autonomous code analysis agent that scans projects for compliance gaps, assesses control state, and generates remediation reports. Covers SOC2 Type II, HIPAA, GDPR, and PCI DSS with framework-specific control mappings.

Input

The /architect:compliance command passes:

{
  "frameworks": ["SOC2", "GDPR"],
  "project": {
    "name": "example-saas",
    "stage": "growth",
    "directory": "/path/to/project"
  },
  "data_sensitivity": {
    "handles_pii": true,
    "handles_phi": false,
    "handles_payment_data": false
  },
  "components": [
    {
      "name": "api-server",
      "type": "backend",
      "language": "typescript",
      "directory": "/path/to/project/api-server",
      "src_dirs": ["src/services", "src/controllers", "src/lib"]
    }
  ],
  "tech_stack": {
    "database": "PostgreSQL",
    "auth": "JWT",
    "deployment": "AWS"
  }
}

Process

Step 1: Load Compliance Skill

Read skills/compliance/SKILL.md in full to understand:

• SOC2 Type II controls (CC, A, C, I categories)
• HIPAA safeguards (access, audit, integrity, transmission security)
• GDPR principles and data rights (access, erasure, portability, consent)
• PCI DSS scope reduction and safe card handling
• Compliance scoring matrix

Step 2: Scan Source Code Per Framework

For each framework, execute a targeted code analysis:

Framework-specific patterns to search:

SOC2 Type II

CC6: Logical and Physical Access Controls

Control	Search Pattern	Code Evidence
CC6.1 - Infrastructure monitoring	prometheus, /metrics, monitoring	src/lib/metrics.ts exports request metrics
CC6.2 - Access control (deployment)	branch protection, code review	GitHub branch settings (external check)
CC6.3 - Change management	git log, auditing	Commit history shows who changed what
CC6.4 - Backup & recovery	backup, pg_dump, RTO, RPO	infrastructure/backups.tf or docker-compose.yml
CC6.7 - Encryption at rest	pgcrypto, encryption, @Encrypted, AES-256	Schema comments or ORM decorators
CC7.2 - Encryption in transit	https, tls, TLS_VERSION	nginx.conf or app.listen(443, ...) with TLS config