Why I Stopped Letting Claude Shell Out for Security Scans

Short summary

Shell-based security scanning by AI agents introduces blind spots—agents can't verify coverage or detect working directory drift, creating false confidence in clean reports. Model Context Protocol fixes this with typed schemas and structured responses. The author learned this while building Cybrium, moving to MCP-based architecture for verifiable security.

• •Shell tools decouple agent confidence from actual security coverage
• •MCP provides typed schemas and structured outputs for verifiable agent-tool contracts
• •Real-world incident: agent scanned wrong directory, shipped with false confidence to staging

Generated with AI, which can make mistakes.