Security debt behaves like the financial kind. Nobody takes it on deliberately. It accrues one skipped base image bump at a time, and the interest shows up as a backlog no one owns.
The pattern is familiar to anyone who has inherited a cloud estate. Hundreds of repos. A fleet of containers nobody fully owns. A vulnerability backlog that earlier cleanup efforts never finished, because every time security handed engineering a list, engineering asked the same question: which of these actually matter?
Then leadership sets a date. Every critical fixed by the end of the month. The security team that has to deliver is small, and the engineers who can fix things live in their own tools. Increasingly that tool is a coding agent that is already reading the repo and writing the diff. The last place they want to be is a security console, and nobody has patience for automation that creates work instead of removing it.
Most tools promise a queue of tickets or auto-generated fix PRs waiting each morning. But can any tool hand the agent enough truth, and enough context, that an engineer would look at what came back and have the confidence to merge it? Here’s how one of our customers did it with Orca.
Why coding agents can’t fix vulnerabilities safely on their own
Give a coding agent a CVE ID and a repo and it will produce a plausible diff, but two things are missing.
The first is ground truth. Which of the thousand findings is real, reachable, and running in production? Where does the vulnerable package actually live: pinned in a requirements.txt or package.json, installed by a RUN apt-get line in a Dockerfile, or inherited from a base image in the FROM line that nobody on the team builds? And which repo, out of hundreds, produced the container that is actually running? The agent can grep for a package name, but grepping across hundreds of repos is how you patch the wrong service.
The second is guardrails. Left alone, an agent will happily bump a major version, swap a base image distro, or push to main because that resolved the finding fastest. Any one of those closes the alert but breaks the service.
Both gaps come down to context and guardrails, and both are solvable today. The stack that solves them has three parts:
- Orca supplies the context
- Orca MCP Server delivers it to the coding agent
- A guided skill sets the guardrails
What context Orca gives the coding agent
A coding agent can read a repo. It cannot see what is running, what is exposed, or which image a container came from. That is what Orca contributes, and three pieces of it carry the fix.
- Code origin. Orca can trace dev risk to production by mapping a running workload back to the code that produced it: the Dockerfile that built the image, the Terraform that deployed the service, the Helm chart that configured it. Any one of those is enough to land the agent in the right repo. For a vulnerability, that is the difference between “there is a vulnerable OpenSSL somewhere in production” and “this Dockerfile, in this repo, line 3.”
- Package and image context. The alert carries the installed version, the fixed versions, and whether the issue is an OS package or an application dependency. That lets the skill pick the smallest patched version in the track already installed instead of guessing at a release that happens to be newer.
- Risk context. Exposure, attack path analysis, and whether the asset holds sensitive data. The agent doesn’t need this to write the fix. The engineer needs it to understand why this one is first, and the skill carries it into the PR description so the reviewer isn’t rebuilding the case from scratch.
Without those three, the agent produces a diff. With them, it produces a diff an engineer can defend: the right repo, the right line, the smallest version that closes the finding, and the reason it was worth doing today.
How the remediation skill works in Claude Code, step by step
The engineer opens Claude Code with the Orca MCP connected and hands the skill an alert ID. From there it runs a fixed playbook.
Screenshot of giving Claude an alert ID from Orca.
- Context gathering: Claude pulls the alert through the MCP, then the code origin. It confirms the repo, the file, and the exact line before touching anything.
- Decision: The skill checks the finding against a short list of issue types it is allowed to fix. For those, it picks the smallest version bump that closes the finding and keeps base images on the same distro. Anything outside that list, including major-version upgrades, end-of-life base images, or a repo that has changed since the scan, stops the run with an explanation instead of a guess.
- Generation: Claude clones the repo, edits the line, and validates the change. When Docker is available locally, the agent builds the image to confirm the fix before it hands anything back.
- Review: The output is a diff. The skill never commits, never pushes, and never touches cloud state. The engineer reads it and approves. Only then does it open a PR on a new branch and write a comment and an in-progress status back to the Orca alert. Once the fix is merged and deployed, Orca closes the alert automatically on the next scan.
Screenshot of the output from the skill – a diff.
Why engineers trusted AI-generated fixes
That last rule did more for adoption than anything else. Engineers trusted the output because it could not do anything they hadn’t read first. The skill was written in the open agent skills format, so the same file runs in Cursor, Codex, or whatever else a team has standardized on. Like most orgs, our customer hadn’t settled on a single coding agent. A remediation workflow that works regardless of which one an engineer opens was a hard requirement.
Results: zero critical vulnerabilities in 30 days
By the deadline, our customer had zero critical alerts. Along the way the same skill cleared more than 200 alerts in a month, every fix produced by Claude Code with Orca’s data behind it and every one merged by an engineer who had read the diff. Security and engineering worked the backlog together, and the security lead was in Claude Code running the skill alongside them.
Orca’s vulnerability management handled the security reasoning: which findings were real and exposed, and where the code that produced them lived. The coding agent did the software engineering. The handoff between the two teams, the step that used to stall every cleanup effort, shrank to a code review.
Keeping the security debt from landing
The same skill now runs on a schedule against new software composition analysis (SCA) alerts and opens a PR for each one before anyone has to ask. To catch risky code before it reaches production, the team flipped Orca’s PR scanning from warn to block for criticals with a fix available, so a new one can’t land on the main branch without the fix in hand.
It also changed how they ship. Once engineering saw that a service with its build definition in a repo got a reviewable fix in minutes, that became the deployment standard. Security influenced an engineering practice without writing a policy because the faster path and the more secure path were the same path.
Screenshot of Orca’s scan results in a pull request.
Orca already knows what is running, what is exposed, and where the code lives. The MCP Server already puts that in front of the coding agent your engineers use every day. A skill turns the two into a workflow with guardrails.
Security debt doesn’t have to keep compounding. This team paid theirs down to zero criticals in a month, and the guardrails they set have prevented new debt from landing.
Get started with the Orca MCP Server
Model Context Protocol (MCP) is an open standard introduced by Anthropic that lets AI assistants connect to external data sources. The Orca MCP Server brings your Orca environment into Claude, making cloud security intelligence accessible through natural language and rich, structured output.
The Orca MCP Server also brings AI-powered investigation and remediation into the tools your engineers already use. For more ways to use it, see: AI chat prompts for the Orca MCP Server.
Want to explore how to use Orca’s MCP Server to eliminate your security debt? Book a personalized demo.
Chat with an Orca Expert