Use BIMP with your coding agent

A coding agent can use BIMP’s live published policy while reviewing or changing container image references in your repository. BIMP provides the policy result and exact approved targets, while the agent prepares repository changes through your normal review process.

Before you begin

Before asking a coding agent to use BIMP:

1. Connect the agent to the BIMP MCP server.
2. Confirm that BIMP tracks the repository and branch you want to work with.
3. Make sure you have a BIMP account with at least Team Member access to the relevant organization.
4. Open the repository in your coding agent so it can read the current files.

BIMP supports Dockerfiles, devcontainer configuration, Compose files, and supported Helm values files. See Supported Artifacts and Languages for current coverage.

Tell your agent when to use BIMP

MCP servers advertise their tools and instructions, but the client model still decides when to call them. Add the following rule to the repository’s AGENTS.md or equivalent instruction file:

Before editing Dockerfiles, devcontainer.json, Compose files, or Helm values
image references, or answering questions about container base images or
container image policy, call BIMP MCP get_remediation_plan with
repository_full_name, branch_name, file_path, and current file_content. Use
check_image_compliance for specific image checks. Do not guess approved target
images from model knowledge.

Repository instructions make the expected behavior repeatable across tasks and help prevent the agent from answering policy questions from model knowledge.

Check an image against policy

Ask the agent to use check_image_compliance when you want to understand whether a specific image or supported artifact is approved, current, mapped, or otherwise governed by BIMP policy.

For example:

Check whether python:3.11 in this Dockerfile complies with BIMP policy. Use the
current file content and do not change the file.

Review the organization, repository, branch, file, and policy context reported by the agent. A response based only on model knowledge does not confirm that the agent checked BIMP.

Plan a remediation

Ask the agent to use get_remediation_plan before it changes image references. The plan returns exact replacement records and policy context for the current artifact.

For example:

Use BIMP to prepare a remediation plan for the container images in this
repository's Dockerfile on the main branch. Use the current file content and
explain each approved replacement before editing the file.

The repository name, branch, file path, and current file content allow BIMP to evaluate the artifact against the correct policy.

Apply and review the proposed changes

When you ask the agent to apply a remediation:

1. The agent retrieves a current remediation plan from BIMP.
2. It explains the approved replacements or shows the proposed diff.
3. It updates only the supported image references covered by the plan.
4. It runs the repository’s normal validation and tests.
5. You review the resulting diff through your normal change process.

The coding agent edits the repository; the BIMP MCP tools do not. Do not ask the agent to substitute a target that BIMP did not return.

Schedule recurring image reviews

If your coding agent supports recurring tasks, you can schedule it to review your supported container files every N days. During each run, the agent should use BIMP MCP to retrieve the current remediation plan, update any out-of-date image references, run the repository’s normal checks, and prepare the changes for review through your usual pull or merge request process.

The scheduled environment must have access to the repository and an authenticated BIMP MCP connection. Configure the task to pass the current file content to BIMP, make changes only when BIMP returns an approved target, and report a successful review without creating a change when every image is already current.

For example:

Every N days, review the supported container image references in this
repository. Use BIMP MCP to retrieve a remediation plan for each relevant file,
passing the repository name, branch, file path, and current file content.

Apply only the exact targets returned by BIMP. Run the repository's normal
checks and prepare a pull or merge request describing the image updates. If no
updates are required, report that the review completed without making changes.
Do not guess approved target images or modify BIMP policy.

The coding-agent platform owns the schedule. BIMP supplies live policy and remediation plans when each scheduled task runs.

Example tasks

Review a file without changing it

Review the images in compose.yaml against BIMP policy. Report any required
updates, but do not edit the file.

Apply approved image updates

Use BIMP to update the governed image references in compose.yaml. Show the
remediation plan first, apply only approved targets, and run the relevant
repository checks.

Review uncommitted changes

Check the current uncommitted Dockerfile against BIMP policy. Pass its current
content so the result includes my local edits.

Explain an approved target

Use BIMP to explain the policy result and approved target for the image in this
Dockerfile. Do not make any changes.

Understand the boundaries

BIMP MCP tools:

• read live published policy available to the signed-in identity;
• evaluate supported image references and artifacts;
• return policy results and exact remediation targets;
• do not create, edit, or publish policy;
• do not change BIMP settings; and
• do not edit repository files.

Follow your normal validation, review, and approval process for changes prepared by a coding agent.