ai-appsec AGENTS.md

AGENTS.md — HAIEC Agent Security MCP (Phase -1 → Phase 18)

Scope: These rules apply ONLY to the haiec-ai-agent-security-free-mcp build session (the multi-phase MCP construction project, ~16-18 phases). They do NOT apply to other projects on this machine. They are loaded automatically when this repo (or the HAIEC-workspace/ parent) is the active workspace.

Persistence: This file is the source of truth for session rules across phases. Do not delete or weaken it mid-project. If a later phase needs to amend a rule, edit this file explicitly and note the change in PHASES.md.

---

1. Workspace Layout

HAIEC-workspace/
├── haiec-ai-agent-security-free-mcp/   ← WRITE HERE (primary working repo)
├── haiec-website/                      ← READ ONLY (junction to ../Haiec Website)
├── llmverify-npm/                      ← READ ONLY (junction to ../llmverify-npm)
└── mcp-tenant-isolation/               ← READ ONLY (junction to ../mcp-tenant-isolation)

• Primary write repo: haiec-ai-agent-security-free-mcp (public, GitHub: subodhkc/haiec-ai-agent-security-free-mcp, default branch main).
• Read-only repos are Windows directory junctions to existing local clones. They share the working tree with those clones — inspect, do not modify.
• No separate llmverify/ repo exists. llmverify-npm is the only LLMVerify repo in scope (user-confirmed 2026-08-16). Do not invent a llmverify/ path.

---

2. Architectural Principles (apply to every phase)

1. Not a wrapper around three scanners. This repo becomes the public Agent Security control surface. LLMVerify and Tenant Isolation remain independent products and independent engines. Compose them ONLY where composition has an actual semantic reason. Never let the architecture drift into "run everything every time."

2. Strict engine independence. scan_ai_security, scan_tenant_isolation, verify_llm_content, and check_deploy_security NEVER automatically invoke one another. Each is selected on its own semantic merit.