FAQs

Heeler is built for security leaders — CISOs, AppSec, ProdSec, and DevSecOps — at companies where developers and AI coding agents work side by side. The platform brings security guidance into the moment of code generation, so AI-assisted development doesn't outpace what review can catch.

Agentic Development Security (ADS) is the emerging security paradigm Forrester introduced for AI-powered software development. It spans prevention, detection, prioritization, remediation, policy, and continuous intelligence across the AI SDLC. Heeler operationalizes that model through three continuous layers: Prevent, Fix, and Operate, all powered by one Context Engine.

The Context Engine is Heeler's foundation: six interconnected dimensions — Code, Cloud, Business, Ownership, Threat, and Agent — automatically built and maintained from your existing tools. Every security decision Heeler makes draws from this context, so what's risky for your organization differs intelligently from what's risky in the abstract.

Heeler ships an MCP server and Agent Skills that AI coding agents (Claude Code, Cursor, GitHub Copilot, and others) read at the moment they generate code — so policy and security context arrive in the agent's reasoning instead of failing review later. A CLI lets developers and agents run the same checks locally before commit.

Heeler runs Block / Warn / Observe guardrails on every PR. Block prevents merge on critical violations. Warn flags issues for reviewer attention without blocking. Observe captures data without changing behavior, so teams can roll out new guardrails risk-free before enforcing them.

Heeler separates the security decision from the agent doing the work. For dependency findings, Heeler computes the exact upgrade target from the dependency graph and live vulnerability data. For supported SAST findings, it selects a deterministic remediation strategy anchored to the proven source-to-sink path. An agent applies the change, your build and CI validate it, and Heeler opens a merge-ready pull request rather than handing you a suggested fix.

Agent Skills Security inventories the instruction files, skills, subagents, hooks, MCP configuration, and related agent configuration already present in your repositories. Heeler analyzes them for deterministic indicators such as hidden Unicode, dangerous commands, excessive permissions, and suspicious external references, then uses semantic analysis to identify risky intent such as prompt injection, exfiltration, privilege escalation, and deception. Each file receives a safety score and verdict so security teams can review the agent supply chain like any other dependency class.

Heeler is built for cloud-first engineering. It connects to the clouds, source-control systems, registries and languages your teams already use, reads what is actually deployed, and needs no agents, no sensors, and no changes to your build.

Heeler is built for teams where AI coding agents are already writing production code. If agents are opening pull requests in your repositories, Heeler applies the same policy at code generation, at commit, at the pull request, and after merge.

Heeler publishes its full pricing: $35 down to $17 per contributing developer per month by volume, billed as an annual subscription with quarterly true-ups. Every tier includes the full platform.

A contributing developer is anyone whose commits land in repos Heeler is scanning. AI agents that commit on behalf of developers count under the human user account, not separately. The pricing unit scales with team size, not with how much code your agents generate.

Yes — Heeler holds a SOC 2 Type II attestation. Our complete compliance posture — controls, attestations, and security practices — is documented at our public Trust Center: trust.heeler.com.