> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/prevent.md).

# Prevent

Stop risk before it merges — prevention at every layer of the AI SDLC.

Stop risk before it merges. The same context — your policy, approved versions, service tier, and exposure — is applied at **all four points risk enters the AI SDLC**: in the agent, at the keyboard, on the PR, and after merge. The checks run earlier and earlier, so nothing depends on a single gate.

| Layer                                                                                                                      | Where it runs                     | What it does                                                                                                                                                      |
| -------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [**MCP Server**](/mrecEO40m5D6bt7Pq5pE/prevent/mcp.md) & [**Agent Skills**](/mrecEO40m5D6bt7Pq5pE/prevent/agent-skills.md) | In the agent — at code generation | The coding agent consults Heeler for live security context and runs scans in natural language, so it checks its own work *before it writes the commit*.           |
| [**CLI**](/mrecEO40m5D6bt7Pq5pE/prevent/cli.md)                                                                            | At the keyboard — before commit   | `heelercli` runs secret, SAST, vulnerability, license, malicious-package, and agent-file checks locally (in a pre-commit hook) and as a build-failing gate in CI. |
| [**PR Guardrails**](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails.md)                                                        | At merge — native status checks   | Your security policy is enforced on every pull request, with full runtime and ownership context, and can Observe, Warn, or Block.                                 |
| [**Workflows**](/mrecEO40m5D6bt7Pq5pE/operate/workflows.md)                                                                | After merge — always on           | The backstop: anything that reaches `main` is caught by automation that tickets, notifies, and can fix it.                                                        |

Most teams run the first three together — the agent and CLI shorten the loop for the developer, and guardrails are the gate every change must pass — with workflows always on behind them.

## In this section

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>MCP Server</strong></td><td>Bring Heeler's live, read-only security context into your AI coding agent as code is written.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/prevent/mcp.md">MCP Server</a></td></tr><tr><td><strong>Agent Skills</strong></td><td>Run Heeler's secret, vulnerability, license, and malicious-package scans — and a full security review — from your agent in natural language.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/prevent/agent-skills.md">Agent Skills</a></td></tr><tr><td><strong>CLI</strong></td><td><code>heelercli</code> — run those same checks at the keyboard and in CI.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/prevent/cli.md">CLI</a></td></tr><tr><td><strong>PR Guardrails</strong></td><td>Enforce your security policy on every pull request as a native status check that can Observe, Warn, or Block.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails.md">PR Guardrails</a></td></tr><tr><td><strong>Package-Manager Cooldown</strong></td><td>Hold new dependency versions for a minimum age in your own package manager, so a compromised release is not adopted the day it ships.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/prevent/package-manager-cooldown.md">Package-Manager Cooldown</a></td></tr></tbody></table>

## Related

* [Findings](/mrecEO40m5D6bt7Pq5pE/findings.md) — what these gates detect, and how it's scored.
* [Fix](/mrecEO40m5D6bt7Pq5pE/fix.md) — remediate what does get through.
* [Set Up Developer Tooling](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling.md) — install the CLI, Agent Skills, and the MCP server.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/prevent.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.