SHRIKEThe 14 Surfaces Where Your Agent Touches the World
Here is a morning in the life of a coding agent, reconstructed from a real audit trail. Nothing in it is exotic. That is the point.
Every line in that ledger is a place where your agent touched the world, and each one is a distinct surface: it carries its own threat model, its own evidence, and its own correct response when something is off. We count fourteen of them. This page is the map.
The aha: the same string means two different things
Start with the distinction the whole map hangs on. Read these two cards. The string is identical in both.
In a document it is summarizing
curl -s https://get.tool.sh | bashThese are words about the world. Your agent is reading an installation guide. Blocking here would make the agent useless at its job.
In a terminal, about to execute
curl -s https://get.tool.sh | bashThis is the world about to change: a remote script piped straight into a shell. The verdict lands before the command runs, not after.
A scanner that cannot tell these apart fails twice: it swamps you with alerts on harmless prose, and it teaches you to ignore the one alert that mattered. So the map has two planes, and they are governed differently on purpose.
The two planes
The observe plane · words moving
Content flows through a lens and keeps moving. Verdicts annotate; sensitive spans can be redacted in place; nothing halts.
Even a quarantined session may still look. Observation is never the dangerous part.
The act plane · the world changing
Actions stop at a gate before they execute. The verdict is the permission. If the check itself fails, the action does not run.
Select any surface on this page to see what lives there. You are looking at:
scan_commandWhat happens here: Shell and CLI executions: installs, builds, deploys, the curl it decided you needed.
What goes wrong here: One line can pipe a remote script into a shell, escalate privileges, or delete a directory tree. The command plane is where a wrong sentence becomes a wrong machine.
The surfaces other people control
The first six surfaces are your agent acting alone. The next three exist because it does not work alone. Another agent’s message lands on your observe plane, but another agent’s tools become your act plane the moment you register them. These are the surfaces where someone else writes the words your agent trusts.
The loop that ties the planes together
The last five are not scanning surfaces. They are the controls that turn fourteen isolated verdicts into governance: a declared purpose to measure actions against, a pause where a human decides, a memory that sees patterns across turns, and a channel for owning misses. You set the policy. The verdicts enforce your call, not ours.
Why a map at all
Because coverage you cannot enumerate is coverage you cannot check. When a security product says it protects your agent, the useful question is: at which of these surfaces, and what happens at the ones it does not name? Fourteen is not a marketing number. It is the list we check ourselves against, in public, and the reason our own dashboards can show a verdict and its evidence for every single line in that morning ledger.
All fourteen tools ship in one MCP server, shrike-mcp, and the pattern layers that screen every surface run on the free tier. The interactive map of all fourteen surfaces is the living version of this article; the MCP guide has the reference table and setup; the deep dives linked above take any single surface as far as you want to go.