# affaan-m/agentshield architecture

> Architecture diagram of the GitHub repository affaan-m/agentshield, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/affaan-m/agentshield
- Repository: https://github.com/affaan-m/agentshield

## Overview

AgentShield audits AI-agent configuration, chiefly by discovering local configuration, applying security rules, grading findings, and presenting reports. The CLI also exposes remediation, policy and baseline workflows, evidence bundles, monitoring, and optional LLM-assisted analysis; MiniClaw is a separate sandboxed agent service. Edges reflect the supplied excerpts, SOURCE INDEX references, and README. Several documented capabilities have no sampled implementation details, so their internal connections are omitted.

Main entry points: [`src/index.ts`](https://github.com/affaan-m/agentshield/blob/main/src/index.ts) (CLI), [`src/scanner/index.ts`](https://github.com/affaan-m/agentshield/blob/main/src/scanner/index.ts) (Discovery and Scan), [`src/miniclaw/server.ts`](https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/server.ts) (MiniClaw Server), [`src/opus/pipeline.ts`](https://github.com/affaan-m/agentshield/blob/main/src/opus/pipeline.ts) (Opus Analysis)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Configuration Scanning"]
  node_scanner["Discovery and Scan<br/>[index.ts]"]
  node_discovery["Config Discovery<br/>[discovery.ts]"]
  node_rule_registry["Rule Registry<br/>[index.ts]"]
  node_rule_modules["Security Rules"]
  node_harnesses["Harness Adapters<br/>[index.ts]"]
  node_skill_health["Skill Health<br/>[health.ts]"]
end

subgraph group_results["Findings and Remediation"]
  node_scoring["Scoring<br/>[score.ts]"]
  node_reporting["Report Formats"]
  node_fixer["Auto-fix<br/>[index.ts]"]
end

subgraph group_governance["Audit Governance"]
  node_policy["Policy Evaluation"]
  node_baseline["Baseline Comparison"]
  node_evidence["Evidence Pack<br/>[index.ts]"]
end

subgraph group_analysis["Advanced Analysis"]
  node_supply_chain["Supply-chain Analysis"]
  node_opus["Opus Analysis<br/>[pipeline.ts]"]
  node_llm["LLM Client<br/>[client.ts]"]
  node_injection["Injection Testing"]
end

subgraph group_operations["Agent Operations"]
  node_watch["Configuration Watch"]
  node_runtime["Runtime Monitor"]
  node_miniclaw_server["MiniClaw Server<br/>[server.ts]"]
  node_miniclaw_router["Prompt Router<br/>[router.ts]"]
  node_miniclaw_sandbox["MiniClaw Sandbox<br/>[sandbox.ts]"]
  node_miniclaw_tools["Safe Tools<br/>[tools.ts]"]
end

node_user(("Developer"))
node_cli["CLI<br/>[index.ts]"]
node_anthropic{{"Anthropic API"}}

node_user -->|"runs commands"| node_cli
node_cli -->|"starts scan"| node_scanner
node_scanner -->|"discovers files"| node_discovery
node_scanner -->|"loads rules"| node_rule_registry
node_rule_registry -->|"registers checks"| node_rule_modules
node_scanner -->|"detects adapters"| node_harnesses
node_scanner -->|"analyzes skills"| node_skill_health
node_cli -->|"scores findings"| node_scoring
node_cli -->|"renders reports"| node_reporting
node_cli -->|"applies fixes"| node_fixer
node_cli -->|"evaluates policy"| node_policy
node_cli -->|"compares baseline"| node_baseline
node_cli -->|"writes bundle"| node_evidence
node_evidence -->|"renders artifacts"| node_reporting
node_cli -.->|"analyzes supply chain"| node_supply_chain
node_cli -->|"runs deep analysis"| node_opus
node_opus -->|"uses scan result"| node_scanner
node_opus -->|"creates client"| node_llm
node_llm -->|"sends requests"| node_anthropic
node_cli -->|"runs injection tests"| node_injection
node_injection -->|"uses client"| node_llm
node_cli -->|"starts watching"| node_watch
node_cli -->|"installs monitor"| node_runtime
node_user -.->|"sends prompts"| node_miniclaw_server
node_miniclaw_server -->|"creates sandbox"| node_miniclaw_sandbox
node_miniclaw_server -->|"routes prompts"| node_miniclaw_router
node_miniclaw_server -->|"builds whitelist"| node_miniclaw_tools
node_miniclaw_router -->|"uses sandbox"| node_miniclaw_sandbox
node_miniclaw_tools -->|"uses sandbox"| node_miniclaw_sandbox

click node_cli "https://github.com/affaan-m/agentshield/blob/main/src/index.ts"
click node_scanner "https://github.com/affaan-m/agentshield/blob/main/src/scanner/index.ts"
click node_discovery "https://github.com/affaan-m/agentshield/blob/main/src/scanner/discovery.ts"
click node_rule_registry "https://github.com/affaan-m/agentshield/blob/main/src/rules/index.ts"
click node_rule_modules "https://github.com/affaan-m/agentshield/tree/main/src/rules"
click node_harnesses "https://github.com/affaan-m/agentshield/blob/main/src/harness-adapters/index.ts"
click node_skill_health "https://github.com/affaan-m/agentshield/blob/main/src/skills/health.ts"
click node_scoring "https://github.com/affaan-m/agentshield/blob/main/src/reporter/score.ts"
click node_reporting "https://github.com/affaan-m/agentshield/tree/main/src/reporter"
click node_fixer "https://github.com/affaan-m/agentshield/blob/main/src/fixer/index.ts"
click node_policy "https://github.com/affaan-m/agentshield/tree/main/src/policy"
click node_baseline "https://github.com/affaan-m/agentshield/tree/main/src/baseline"
click node_evidence "https://github.com/affaan-m/agentshield/blob/main/src/evidence-pack/index.ts"
click node_supply_chain "https://github.com/affaan-m/agentshield/tree/main/src/supply-chain"
click node_opus "https://github.com/affaan-m/agentshield/blob/main/src/opus/pipeline.ts"
click node_llm "https://github.com/affaan-m/agentshield/blob/main/src/llm/client.ts"
click node_injection "https://github.com/affaan-m/agentshield/tree/main/src/injection"
click node_watch "https://github.com/affaan-m/agentshield/tree/main/src/watch"
click node_runtime "https://github.com/affaan-m/agentshield/tree/main/src/runtime"
click node_miniclaw_server "https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/server.ts"
click node_miniclaw_router "https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/router.ts"
click node_miniclaw_sandbox "https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/sandbox.ts"
click node_miniclaw_tools "https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/tools.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scanner,node_discovery,node_rule_registry,node_rule_modules,node_harnesses,node_skill_health toneBlue
class node_scoring,node_reporting,node_fixer toneAmber
class node_policy,node_baseline,node_evidence,node_anthropic toneMint
class node_supply_chain,node_opus,node_llm,node_injection toneRose
class node_watch,node_runtime,node_miniclaw_server,node_miniclaw_router,node_miniclaw_sandbox,node_miniclaw_tools,node_user toneIndigo
class node_cli toneTeal
```

## Components

### Configuration Scanning

- [Discovery and Scan](https://github.com/affaan-m/agentshield/blob/main/src/scanner/index.ts): `src/scanner/index.ts`
- [Config Discovery](https://github.com/affaan-m/agentshield/blob/main/src/scanner/discovery.ts): `src/scanner/discovery.ts`
- [Rule Registry](https://github.com/affaan-m/agentshield/blob/main/src/rules/index.ts): `src/rules/index.ts`
- [Security Rules](https://github.com/affaan-m/agentshield/tree/main/src/rules): `src/rules`
- [Harness Adapters](https://github.com/affaan-m/agentshield/blob/main/src/harness-adapters/index.ts): `src/harness-adapters/index.ts`
- [Skill Health](https://github.com/affaan-m/agentshield/blob/main/src/skills/health.ts): `src/skills/health.ts`

### Findings and Remediation

- [Scoring](https://github.com/affaan-m/agentshield/blob/main/src/reporter/score.ts): `src/reporter/score.ts`
- [Report Formats](https://github.com/affaan-m/agentshield/tree/main/src/reporter): `src/reporter`
- [Auto-fix](https://github.com/affaan-m/agentshield/blob/main/src/fixer/index.ts): `src/fixer/index.ts`

### Audit Governance

- [Policy Evaluation](https://github.com/affaan-m/agentshield/tree/main/src/policy): `src/policy`
- [Baseline Comparison](https://github.com/affaan-m/agentshield/tree/main/src/baseline): `src/baseline`
- [Evidence Pack](https://github.com/affaan-m/agentshield/blob/main/src/evidence-pack/index.ts): `src/evidence-pack/index.ts`

### Advanced Analysis

- [Supply-chain Analysis](https://github.com/affaan-m/agentshield/tree/main/src/supply-chain): `src/supply-chain`
- [Opus Analysis](https://github.com/affaan-m/agentshield/blob/main/src/opus/pipeline.ts): `src/opus/pipeline.ts`
- [LLM Client](https://github.com/affaan-m/agentshield/blob/main/src/llm/client.ts): `src/llm/client.ts`
- [Injection Testing](https://github.com/affaan-m/agentshield/tree/main/src/injection): `src/injection`

### Agent Operations

- [Configuration Watch](https://github.com/affaan-m/agentshield/tree/main/src/watch): `src/watch`
- [Runtime Monitor](https://github.com/affaan-m/agentshield/tree/main/src/runtime): `src/runtime`
- [MiniClaw Server](https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/server.ts): `src/miniclaw/server.ts`
- [Prompt Router](https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/router.ts): `src/miniclaw/router.ts`
- [MiniClaw Sandbox](https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/sandbox.ts): `src/miniclaw/sandbox.ts`
- [Safe Tools](https://github.com/affaan-m/agentshield/blob/main/src/miniclaw/tools.ts): `src/miniclaw/tools.ts`

### Other components

- **Developer**
- [CLI](https://github.com/affaan-m/agentshield/blob/main/src/index.ts): `src/index.ts`
- **Anthropic API**

## Connections

- Developer → CLI: runs commands (evidence: `README.md`)
- CLI → Discovery and Scan: starts scan (evidence: `src/index.ts`)
- Discovery and Scan → Config Discovery: discovers files (evidence: `src/scanner/index.ts`)
- Discovery and Scan → Rule Registry: loads rules (evidence: `src/scanner/index.ts`)
- Rule Registry → Security Rules: registers checks (evidence: `src/rules/index.ts`)
- Discovery and Scan → Harness Adapters: detects adapters (evidence: `src/scanner/index.ts`)
- Discovery and Scan → Skill Health: analyzes skills (evidence: `src/scanner/index.ts`)
- CLI → Scoring: scores findings (evidence: `src/index.ts`)
- CLI → Report Formats: renders reports (evidence: `src/index.ts`)
- CLI → Auto-fix: applies fixes (evidence: `src/index.ts`)
- CLI → Policy Evaluation: evaluates policy (evidence: `src/index.ts`)
- CLI → Baseline Comparison: compares baseline (evidence: `src/index.ts`)
- CLI → Evidence Pack: writes bundle (evidence: `src/index.ts`)
- Evidence Pack → Report Formats: renders artifacts (evidence: `src/evidence-pack/index.ts`)
- CLI → Supply-chain Analysis: analyzes supply chain (evidence: `src/index.ts`)
- CLI → Opus Analysis: runs deep analysis (evidence: `src/index.ts`)
- Opus Analysis → Discovery and Scan: uses scan result (evidence: `src/opus/pipeline.ts`)
- Opus Analysis → LLM Client: creates client (evidence: `src/opus/pipeline.ts`)
- LLM Client → Anthropic API: sends requests (evidence: `src/llm/client.ts`)
- CLI → Injection Testing: runs injection tests (evidence: `src/index.ts`)
- Injection Testing → LLM Client: uses client (evidence: `src/injection/index.ts`)
- CLI → Configuration Watch: starts watching (evidence: `src/index.ts`)
- CLI → Runtime Monitor: installs monitor (evidence: `src/index.ts`)
- Developer → MiniClaw Server: sends prompts
- MiniClaw Server → MiniClaw Sandbox: creates sandbox (evidence: `src/miniclaw/server.ts`)
- MiniClaw Server → Prompt Router: routes prompts (evidence: `src/miniclaw/server.ts`)
- MiniClaw Server → Safe Tools: builds whitelist (evidence: `src/miniclaw/server.ts`)
- Prompt Router → MiniClaw Sandbox: uses sandbox (evidence: `src/miniclaw/router.ts`)
- Safe Tools → MiniClaw Sandbox: uses sandbox (evidence: `src/miniclaw/tools.ts`)