COPS (Copilot Operations Plugins for Security) is a cybersecurity project for security-focused plugins, agents, and skills. It provides practical add-ons for coding assistants that help developers and security teams understand repositories and improve defensive security workflows.
The first included plugin, COPS Security Logging Advisor, combines a local Python scanner, a specialist agent, and reusable skills for cost-aware security logging reviews. See the capability catalog for what is available today and how additional cybersecurity add-ons fit the project.
The scanner identifies languages, frameworks, cloud and infrastructure signals, and potential credential locations. The advisor uses that context to recommend structured audit events, redaction, correlation fields, and environment-specific telemetry. Reports require review; pattern matching does not prove security or compliance.
Use Python 3.11 or newer and Git. The scanner and package validator use only the
Python standard library. Contributor tests additionally require requirements.txt.
git clone https://github.com/sodejm/copilot-operation-plugin-for-security.git
cd copilot-operation-plugin-for-security
python3 plugins/logging-telemetry/security-logging-advisor/scripts/validate-plugin.py
python3 plugins/logging-telemetry/security-logging-advisor/skills/repository-context/scripts/collect-repository-context.py .The scanner writes JSON to standard output. Give the agent the advisor instructions and reviewed context to produce a report. Follow the installation guide for the host-specific integration boundary and local fallback.
The separate COPS SOC Investigation Workbench adds two Codex skills and a local Python case planner for evidence associations, competing hypotheses, branching investigations, and bounded next steps. Hunt workflows remain owned by Sentinel and are integrated through unchanged vendor snapshots. The planner works locally; its Sentinel integration is pending the canonical skills and catalog. See its README for setup and verified limits.
python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install -r requirements.txt
make doctor
make checkOn Windows, activate .venv\Scripts\Activate.ps1 in PowerShell. If Make is
unavailable, run python3 scripts/agent/doctor.py and
python3 scripts/agent/check.py directly.
Read AGENTS.md and CONTRIBUTING.md before changing
the repository. COPS adopts the portable contracts, skills, adapters, and checks
from PARK. Edit canonical
skills in .agents/skills/, then run make sync-agent-adapters.
- Documentation index and repository architecture
- Naming conventions and template adoption record
- Cybersecurity capabilities and GitHub discoverability
- Plugin architecture and model routing
- Security and privacy and security reporting
- Enterprise rollout and maintainer guide
- Plugin specification and conformance specification
Existing COPS project material retains the PolyForm Noncommercial License 1.0.0. Imported PARK material retains its Apache-2.0 notices; see third-party notices and licensing.
The packaged CVE reachability agent guides repository-specific investigations. Start with its skill and runnable helper commands. The helper creates unresolved reports and checks evidence integrity and structure. Dependency resolution, call graphs, taint analysis and runtime validation require separate tools and analyst review; no automatic reachability proof or host installation is claimed. See the workflow and report contract.