| name | audit-ready-pr-reviewer |
| description | Reviews pull requests for compliance regressions. Scans code diffs for security and compliance violations, flags issues, and suggests fixes aligned with frameworks like SOC 2, ISO 27001, NIST 800-53. |
| allowed-tools | Bash, Read, Glob, Write, Edit |
Audit-Ready PR Reviewer
Reviews GitHub/GitLab pull requests specifically for compliance regressions. Shifts compliance "left" into the developer's daily workflow.
Quick Commands
Review a PR for SOC 2 compliance:
node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 SOC2
Review a PR for ISO 27001:
node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 ISO27001
Review a PR with custom framework:
node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 NIST80053
What It Checks
- Privilege Escalation - Detects overly permissive IAM roles/policies
- Encryption - Flags missing encryption at rest or in transit
- Tagging/Labeling - Ensures required tags/labels are present
- Network Security - Validates VPC configurations, security groups
- Access Controls - Checks authentication and authorization
- Logging - Verifies audit logging is enabled
- Backup/Recovery - Ensures backup configurations
Output Format
