# Use Cases

SigilAI's security scanning capabilities integrated through the Model Context Protocol (MCP) enable numerous valuable use cases across different industries and user types. This document highlights key scenarios where SigilAI delivers significant value.

### AI Assistant Security Enhancement

#### Scenario: Secure URL Verification

**Challenge:**\
Users frequently ask AI assistants to visit, analyze, or provide information about URLs, but traditional AI systems have no way to verify if these URLs are malicious or safe.

**Solution:**\
SigilAI enables AI assistants to:

1. Receive URL requests from users
2. Pass URLs to the SigilAI MCP server for security scanning
3. Analyze the safety results before taking action
4. Warn users about potential threats or proceed with confidence

**Implementation:**

<figure><img src="https://2748511689-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWyQn1eu5V1hFHmHhQYDj%2Fuploads%2F55lpTDaFShkjcYQ41Wos%2FD1.jpg?alt=media&#x26;token=08871134-2866-419d-98c7-e18bf37e5307" alt="" width="563"><figcaption></figcaption></figure>

**Benefits:**

* Prevents AI systems from inadvertently directing users to malicious sites
* Reduces liability for AI platform providers
* Builds user trust through demonstrated security awareness
* Creates an additional security layer for organizational deployments

#### Scenario: Code Security Validation

**Challenge:**\
Developers increasingly ask AI assistants to review, generate, or explain code, but without security validation, AIs may inadvertently promote vulnerable coding patterns.

**Solution:**\
SigilAI enables AI assistants to:

1. Analyze user-submitted code for security vulnerabilities
2. Scan AI-generated code before presenting it to users
3. Highlight security issues with clear explanations
4. Suggest secure alternatives to vulnerable patterns

**Benefits:**

* Prevents propagation of insecure coding practices
* Educates developers about security best practices
* Reduces the risk of vulnerabilities in production code
* Enhances the value proposition of AI coding assistants

### Enterprise Security Integration

#### Scenario: Secure Development Workflow

**Challenge:**\
Organizations struggle to integrate security scanning into development workflows without disrupting developer productivity or requiring specialized security expertise.

**Solution:**\
SigilAI provides:

1. Seamless integration with existing development tools and AI assistants
2. Automated security scanning during code reviews
3. Contextual security insights within developer environments
4. Clear remediation guidance without security jargon

**Implementation Example:**

{% tabs %}
{% tab title="TypeScript" %}
```typescript
// Example integration in a CI/CD pipeline
import { scanCode, ScanResult, FileObject } from 'sigilai-client'; // Assuming types from client

// Placeholder for actual implementation - these would come from your CI environment
declare function getChangedFiles(): FileObject[];
declare function reportIssues(vulnerabilities: any[]): void;

interface FileObject {
  path: string;
  content: string;
  extension: string; // Or derive it from path
}

interface ScanResult { // Simplified, actual type would be provided by sigilai-client
  vulnerabilities: any[]; // Assuming vulnerabilities is an array of some type
}

async function securityStage(): Promise<void> {
  // Scan changed files in the pull request
  const changedFiles: FileObject[] = getChangedFiles();
  
  for (const file of changedFiles) {
    // Basic check for JavaScript or TypeScript files
    if (file.path.endsWith('.js') || file.path.endsWith('.ts')) {
      try {
        const result: ScanResult = await scanCode({
          path: file.path,
          content: file.content
        });
        
        if (result.vulnerabilities && result.vulnerabilities.length > 0) {
          reportIssues(result.vulnerabilities);
          console.error(`Security issues found in ${file.path}. Failing build.`);
          process.exit(1); // Fail the build on security issues
        }
      } catch (error) {
        console.error(`Error scanning file ${file.path}:`, error);
        // Decide if scanning errors should fail the build
        // process.exit(1); 
      }
    }
  }
  
  console.log('No security issues found in scanned files.');
}

securityStage().catch(error => {
  console.error('Unhandled error in security stage:', error);
  process.exit(1);
});
```
{% endtab %}

{% tab title="JavaScript" %}
```javascript
// Example integration in a CI/CD pipeline
const { scanCode } = require('sigilai-client'); // Assuming sigilai-client is CJS

// Placeholder for actual implementation - these would come from your CI environment
function getChangedFiles() {
  // This function would typically interact with your CI system's API
  // to get a list of changed files in a pull request or commit.
  // Example: return [{ path: 'src/index.js', content: '...', extension: '.js' }];
  console.warn("getChangedFiles() is a placeholder and needs actual implementation.");
  return []; 
}

function reportIssues(vulnerabilities) {
  // This function would typically format and send vulnerability reports
  // to a dashboard, logging system, or create comments in a PR.
  console.warn("reportIssues() is a placeholder. Vulnerabilities:", vulnerabilities);
}

async function securityStage() {
  // Scan changed files in the pull request
  const changedFiles = getChangedFiles();
  
  for (const file of changedFiles) {
    // Basic check for JavaScript or TypeScript files
    // A more robust check might involve looking at file.extension if available
    if (file.path.endsWith('.js') || file.path.endsWith('.ts')) {
      try {
        const result = await scanCode({
          path: file.path,
          content: file.content
        });
        
        if (result.vulnerabilities && result.vulnerabilities.length > 0) {
          reportIssues(result.vulnerabilities);
          console.error(`Security issues found in ${file.path}. Failing build.`);
          process.exit(1); // Fail the build on security issues
        }
      } catch (error) {
        console.error(`Error scanning file ${file.path}:`, error);
        // Decide if scanning errors should fail the build
        // process.exit(1);
      }
    }
  }
  
  console.log('No security issues found in scanned files.');
}

securityStage().catch(error => {
  console.error('Unhandled error in security stage:', error);
  process.exit(1);
});
```
{% endtab %}
{% endtabs %}

**Benefits:**

* Minimizes context switching for developers
* Reduces mean time to remediation for vulnerabilities
* Provides security guardrails without blocking productivity
* Enables "shift left" security without additional complexity

#### Scenario: Security Compliance Documentation

**Challenge:**\
Organizations need to demonstrate security due diligence for compliance purposes, but gathering and formatting security evidence is time-consuming and often incomplete.

**Solution:**\
SigilAI helps organizations:

1. Automatically document security scan results
2. Generate compliance-ready security reports
3. Maintain audit trails of security validations
4. Track remediation of identified vulnerabilities

**Benefits:**

* Streamlines security compliance documentation
* Provides evidence of security best practices
* Reduces manual effort for compliance reporting
* Helps satisfy requirements for standards like SOC 2, ISO 27001, etc.

### Educational Use Cases

#### Scenario: Developer Security Training

**Challenge:**\
Traditional security training is often theoretical and disconnected from developers' daily work, making it difficult to apply security principles in practice.

**Solution:**\
SigilAI enables:

1. Just-in-time security education based on real code
2. Contextual explanations of identified vulnerabilities
3. Immediate feedback on security improvements
4. Practical security learning integrated with development

**Example Learning Flow:**

```mermaid
graph TD
    A[Developer writes code] --> B[Code scanned by SigilAI]
    B --> C{Vulnerabilities found?}
    C -->|Yes| D[Display contextual explanation]
    D --> E[Provide secure alternative]
    E --> F[Developer fixes code]
    F --> B
    C -->|No| G[Positive reinforcement]
```

**Benefits:**

* Accelerates security knowledge acquisition
* Makes security concepts tangible through real examples
* Creates continuous learning opportunities
* Builds a security-aware development culture

### Security Operations Use Cases

#### Scenario: URL Threat Intelligence

**Challenge:**\
Security teams need to quickly assess the risk of URLs reported by users or found in logs, but traditional threat intelligence platforms require context switching and specialized knowledge.

**Solution:**\
SigilAI provides:

1. Instant security assessment of reported URLs
2. Comprehensive threat intelligence through MCP
3. Clear risk categorization and explanations
4. Automated handling of common URL threats

**Benefits:**

* Reduces response time for URL security incidents
* Enables first-line support to handle URL security questions
* Provides consistent security assessment methodology
* Integrates with existing security workflows

#### Scenario: Supply Chain Security Validation

**Challenge:**\
Organizations increasingly rely on third-party code and packages, creating significant supply chain security risks that are difficult to assess.

**Solution:**\
SigilAI helps security teams:

1. Scan dependencies for known vulnerabilities
2. Detect suspicious code patterns in third-party libraries
3. Evaluate the security impact of dependencies
4. Prioritize supply chain risks based on usage context

**Benefits:**

* Reduces supply chain attack surface
* Provides early warning of dependency issues
* Enables risk-based prioritization of remediation
* Supports secure vendor selection processes

### Industry-Specific Use Cases

#### Financial Services

* **Phishing URL Detection**: Scanning client-reported suspicious URLs
* **Secure Client Communications**: Validating URLs before including in client communications
* **Regulatory Compliance**: Documenting security due diligence
* **Secure Development**: Ensuring financial applications meet security standards

#### Healthcare

* **PHI Protection**: Ensuring code doesn't contain embedded patient data
* **Secure Patient Portals**: Validating links to external healthcare resources
* **Compliance Verification**: Meeting HIPAA security requirements
* **Third-Party Integration Security**: Validating interfaces with healthcare partners

#### Technology Companies

* **Open Source Security**: Validating contributions to open source projects
* **Product Security**: Scanning product code for vulnerabilities
* **Customer Environment Protection**: Ensuring deployed code is secure
* **API Security Validation**: Verifying API implementations for security issues

***

For more information about the business value of SigilAI, see:

* [Market Need](market-need)
* [Security Landscape](security-landscape)
* [ROI & Benefits](roi-and-benefits)
