Agentic AI Workflow

This guide explains how to configure an IDE or Agentic Workflow client to communicate with a deployed Model Context Protocol (MCP) server for use with SD Elements.

Once configured, your client (IDE plugin, local script, or agent) can securely interact with SD Elements to enable agentic security workflows over HTTP.

Overview

Security requirement generation in SD Elements has traditionally relied on structured workflows, including questionnaires, predefined mappings, and human review cycles. These approaches provide consistency and control, but can require repeated effort as applications evolve and teams scale. Agentic AI introduces a new way to interact with these existing workflows.

Agentic Workflow

Enables AI agents to perform context-aware, multi-step actions across SD Elements projects and security workflows for automation and assistance.

Model Context Protocol (MCP)

A standardized, secure, and auditable way for AI agents to interact with SD Elements while respecting existing permissions and governance controls.

Using Model Context Protocol (MCP), AI agents can connect to SD Elements and perform actions on behalf of a user through a defined set of tools. This allows users to generate, review, and update security artifacts — such as projects and security requirements — using natural language prompts or predefined workflow prompts.

This does not replace existing SD Elements capabilities. Instead, it provides an additional interaction model that can assist with common tasks, reduce repetitive steps, and surface relevant information more quickly.

Why Deploy Agentic AI Workflow?

Agentic Workflow allows teams to bring SD Elements directly into their AI-assisted development workflow.

Once deployed, developers and security teams can:

  • Interact with SD Elements from their IDE or AI client

  • Plan and configure projects using real repository context

  • Update requirements as code evolves

  • Validate policy alignment without leaving their workspace

  • Generate summaries or cross-project insights on demand

  • Verify countermeasures against live scan results and keep issue trackers in sync on demand

Instead of manually navigating SD Elements, users can leverage AI agents to perform structured, permission-aware actions through MCP.

How Teams are Using Agentic AI

Once deployed and connected to an AI client, Agentic Workflow becomes part of the team’s daily development process.

Developers can:

  • Plan new projects directly from repository context

  • Update security requirements as code evolves

  • Run surveys without leaving their IDE

  • Validate policy alignment during development

  • See security status directly in the tools they already use — such as Jira, GitHub, Azure DevOps, or Rally — instead of a separate portal

Security Teams can:

  • Review and adjust project configurations at scale

  • Maintain alignment to evolving policies

  • Analyze security posture across multiple projects

  • Generate executive-ready summaries

  • Verify countermeasures against a live-connected scanner without leaving the agent

  • Keep issue tracker tasks in sync with countermeasure status, with deduplication and status write-back handled server-side

Suggested Workflow

The following example demonstrates how a developer might use Agentic Workflow with an existing repository through a supported AI client.

Plan a New Project from a Repository

  1. Start a new agent session.

  2. Select Plan Mode (or equivalent) and choose your preferred model.

  3. Ensure your terminal or workspace is pointed at the target code repository.

  4. Use the Set Up Security Plan from Existing Codebase (/setup-security-plan-from-repo) prompt. This prompt analyzes the target repository, configures an SD Elements survey, and commits it. Countermeasure retrieval and skill file generation are handled separately by /generate-security-skill-files.

  5. Allow the agent to complete the workflow.

Validate the Project in SD Elements

After execution, confirm:

  • A new SD Elements project was created (or updated) successfully.

  • Survey responses include expected comments.

  • Publishing the survey generated the corresponding countermeasures.

  • The correct project profile appears in the Overview tab.

Generate Security Skill Files

Once the survey is committed, generate the artifacts the agent will act on.

  1. Start a new agent session.

  2. Use the Generate Security Skill Files (/generate-security-skill-files) prompt.

  3. Select the countermeasures to work on.

  4. Allow the agent to classify the countermeasures and generate the files.

Confirm that:

  • An AGENTS.md file was written to the repository root.

  • Per-countermeasure SKILL.md files were generated under skills/.

  • PROCESS countermeasures were recorded as notes in SD Elements rather than as files.

Verify Countermeasure Relevance

Before implementing fixes, it is recommended to validate which countermeasures are applicable to the current codebase.

SD Elements supports two verification methods — use whichever fits the moment:

  • Verify Security Countermeasures via AI Code Scan (/code-scan-verification-validation) — the agent reads your source files directly and derives a verdict with cited evidence. Works with no scanner setup required; best for deep, evidence-based review.

  • Verify Countermeasures with a Security Scanner (/verify-with-scanner) — the agent drives your already-connected scanner (e.g. SonarQube, Snyk, Veracode) through SD Elements' own analysis integration and reads back the results. Faster when a live scanner connection already exists, but requires a remote connection — it can’t trigger a file-upload connection.

    1. Start a new agent session.

    2. Use the AI Code Scan or Security Scanner verification prompt, depending on which method fits (see above).

    3. Allow the agent to assess the codebase (or trigger the scan) and record verification results in SD Elements.

Confirm that:

  • Relevant countermeasures include verification notes.

  • Existing security controls are identified where applicable.

  • The project team has a baseline understanding of which countermeasures require remediation.

Apply Security Fixes

  1. Start a new agent session.

  2. Use the Apply Security Fixes to Codebase (/apply-security-fixes) prompt provided.

  3. Allow the agent to implement the recommended updates.

  4. Review and validate the proposed changes according to your development practices.

Confirm that:

  • Countermeasure statuses were updated as expected.

  • Implementation notes were recorded.

  • The application builds and functions as expected.

Countermeasure Skill Files Classification Logic

Classification happens during /generate-security-skill-files, before any files are written.

Each countermeasure is classified into one of three categories. This classification determines what — if anything — gets generated, and where the resulting record lives.

  • CODE_FIX The fix lives in your code or configuration — e.g. SQL injection, CORS misconfiguration, hardcoded secrets, Dockerfile issues. → Generates a SKILL file.

  • INFRA The fix requires changes to infrastructure outside the repository — e.g. Docker daemon TLS configuration, database server hardening, reverse proxy or WAF rules. → Generates a doc-only SKILL file (describes the required change; there is no code to modify).

  • PROCESS The item is purely organizational, with nothing to change in code or infrastructure — e.g. code review policy, breach notification procedures, maintaining a data-processing register. → Recorded as a note in SD Elements only. No SKILL file is generated.

Category Fix Location Output Tracked in AGENTS.md

CODE_FIX

Repository code/config

SKILL file

Yes

INFRA

Outside the repository

Doc-only SKILL file

Yes

PROCESS

Organizational / people

Note in SD Elements

No

Re-Verify Applied Fixes

After remediation is complete, run the Verify Security Countermeasures via AI Code Scan prompt again against the updated repository.

Confirm that:

  • Verification results were recorded for applicable countermeasures.

  • Remediated findings were successfully addressed or documented.

  • Remaining gaps are clearly identified for follow-up.

  • Countermeasure statuses accurately reflect the current state of remediation.

Sync to Issue Tracker

Once countermeasure status reflects the current state of remediation, sync outstanding and completed work into your team’s issue tracker.

  1. Start a new agent session.

  2. Use the Generate Issue Tracker Tasks from an SD Elements Project (/generate-issue-tracker-tasks) prompt.

  3. Allow the agent to resolve or create the project’s tracker connection, then trigger and confirm the sync.

Confirm that:

  • Every in-scope countermeasure was accounted for — created, updated, already in sync, or explicitly reported as failed.

  • Tracker links for created/updated tasks were written back to SD Elements.

  • No countermeasure was silently dropped from the sync.

This step is typically run last, after countermeasure status has stabilized — syncing too early just means re-syncing later as status changes.

Recommended Best Practices on Workflow

  • Review agent-generated changes before committing updates.

  • Use separate agent sessions for major workflow steps when possible.

  • Larger, more capable models typically perform better for complex repositories.

  • Run the live-connector scan (/verify-with-scanner) as a fast baseline when a scanner connection already exists; fall back to AI code-read verification (/code-scan-verification-validation) for deeper review of ambiguous or unmatched findings.

  • Sync to your issue tracker only after countermeasure status is finalized, to avoid syncing incomplete work and having to re-sync.

Supported AI Clients and Agents

The SD Elements MCP Server is compatible with MCP-capable AI clients and agents. The following have been fully validated:

Validated Clients and Agents:

Client Type Agent Validated Models

Cursor

IDE

—

Gemini 3.1, Claude Opus 4.6, Codex 5.3, GPT 5.2

Claude Code

CLI Agent

—

Claude Opus 4.6

VS Code

IDE

GitHub Copilot

GPT 5.2
Larger, more capable models generally produce better results for multi-step agentic workflows. Other MCP-capable clients may work but have not yet been fully validated.

Other MCP-capable clients may work but are not yet fully validated.

  • Claude Desktop (Requires Proxy Configurations)

results matching ""

    No results matching ""