
Built the agentBut still can’t get production access approved?
Heron interviews your AI agents, maps exactly what access they need, and generates compliance-ready reports — so security can approve with confidence
Run locally with npx, add as a Claude Code skill, or sign in for a hosted dashboard.
See Heron in action
Watch a real audit run end-to-end — from one command to a full report with 9 systems mapped, 1 critical issue, and 5 high-severity findings.
Production rollout gets blocked when access is too broad or too vague
Most teams don’t fail because the agent is broken. They fail because the access request is too broad, too vague, or too risky for security to approve.
Security and IT do not want to approve a permission set that gives the agent more access than the task actually needs. Heron audits what the agent actually needs and generates a report that makes the access request reviewable.
How Heron Works
Give your agent one prompt
Paste this into your agent's chat or set OPENAI_BASE_URL. The agent calls Heron's endpoint and the interview starts automatically.
I need you to complete a security access review for this project.
Make sequential API calls to the Heron endpoint until it says "Interview complete".
Step 1 — Start the interview:
POST https://heron.ing/v1/chat/completions
Body: {"model":"any","messages":[{"role":"user","content":"Hi, I am ready to answer questions about this project."}]}
The response will contain a question and a session ID (in the "heron_session_id" JSON field).
Step 2 — Send each answer:
POST https://heron.ing/v1/chat/completions
Body: {"model":"any","messages":[{"role":"user","content":"YOUR ANSWER HERE"}],"heron_session_id":"SESSION_ID_FROM_STEP_1"}
Step 3 — Repeat step 2 until the response says "Interview complete".
Important: answer about THIS specific project — what you actually do, what systems
you connect to, what data you handle. Not general capabilities. Never reveal actual
secret values — just describe credential types.Heron interviews the agent
10 structured questions covering access, data, writes, frequency, and regulatory impact — with smart follow-ups. Typically 2-3 minutes.
"List every system you ACTUALLY connect to in this project.
Format per system: Name → API type → Auth method
Example: Google Sheets → REST API → OAuth2 (spreadsheets.edit)
Only list systems you have actually used in this deployment — not ones that are theoretically available."
"1. LinkedIn (via Apify) → REST API → Apify API token
2. Google Sheets → REST API (v4) → OAuth 2.0"
"For Google Sheets, specify the exact OAuth scopes you request during the authorization process?"
"googleapis.com/auth/spreadsheets — full read/write
googleapis.com/auth/drive.file — files created by the app"
Get an approval-ready report
Per-system access cards, risk scoring, data quality metrics, and actionable verdict. Attach to SOC 2, ISO 27001, or GDPR evidence.
Findings
Regulatory
Quick Start
Open source. Self-hosted. One command to start auditing your agents locally. Your data stays on your machine.
Star on GitHub$ npx heron-aiThen connect your agent
Paste a prompt
Copy the prompt into your agent's chat. It will call the API and complete the audit.
POST /v1/chat/completionsOverride base URL
Your agent thinks it's talking to OpenAI. No code changes needed.
OPENAI_BASE_URL=...3700/v1Scan an agent
Heron connects to the agent and conducts the interview directly.
heron scan --target .../heron-audit
Install the skill once. Then type /heron-audit in any Claude Code session. Claude reads the codebase, interviews itself about what the project accesses, and generates a compliance-grade report. No server, no API keys.
- Works in any project — Claude reads source code directly
- Generates markdown report saved to your repo
- Zero setup — no server, no env variables
# Install the skill$ bash Heron/skills/heron-audit/install.shThen in Claude Code:
> /heron-auditClaude reads your project and generates the audit report automatically.
Or just sign in
Same audit engine, hosted for you. No local setup, no API keys. Point your agents at the dashboard endpoint and everything is saved automatically.
Audit history
All sessions in one place
Saved reports
Full transcripts and risk analysis
Risk trends
Track compliance over time
Coming soonTeam access
Share reports across the team
Coming soonFree. No credit card required.
Ready to audit your agents?
Free hosted dashboard. Or npx heron-ai for local use.