comp-agent: Instructions file for Claude Code

CompliancePilot v2

Zero-code AWS compliance engine powered by Claude Code. SOC 2 + HIPAA scanning, remediation, and audit reporting — all driven by configuration files.

Architecture

No application code. Claude Code IS the engine. Configuration files provide:

• Agents (agents/) — scanner, remediator, auditor
• Skills (skills/) — /scan, /remediate, /posture, /audit-report
• Rules (rules/) — SOC 2 and HIPAA control-to-Prowler-check mappings
• Hooks (hooks/) — AWS guardrail blocking destructive operations
• MCP (.mcp.json) — AWS API access via awslabs MCP server

Directory Structure

.compliance/              # Runtime data (gitignored, created in user's project)
  scans/                  # Raw Prowler OCSF JSON output
  findings/               # One JSON file per failed check: FINDING-{service}-{hash}.json
  evidence/               # Before/after state per remediation
  reports/                # Generated audit reports

Finding Lifecycle

open → in_progress → remediated → verified
                  ↘ skipped

• open: Prowler detected a failure, finding created
• in_progress: Remediator is working on it
• remediated: Fix applied, awaiting verification
• verified: Re-scan confirms the fix worked
• skipped: User chose to accept the risk

Finding JSON Schema

Each finding is stored as .compliance/findings/FINDING-{service}-{hash}.json:

{
  "id": "FINDING-s3-a1b2c3d4",
  "scanId": "scan-20260302-143022",
  "status": "open",
  "source": {
    "checkId": "s3_bucket_default_encryption",
    "checkTitle": "S3 bucket without default encryption",
    "service": "s3",
    "severity": "high"
  },
  "resource": {
    "arn": "arn:aws:s3:::my-bucket",
    "region": "us-east-1",
    "account": "123456789012"
  },
  "compliance": [
    { "framework": "soc2", "controls": ["CC6.7"] },
    { "framework": "hipaa", "controls": ["164.312(a)(1)"] }
  ],
  "description": "Human-readable description of the issue.",
  "remediation": {
    "recommendation": "What to do",
    "awsCli": "aws ... exact command"
  },
  "fix": {
    "status": "pending",
    "proposedAt": null,
    "appliedAt": null,
    "verifiedAt": null
  }
}