Collect findings
read reports from other Watchdog dogs in the session or the report directory.
The pack · 14 / 14 →
Compliance
Pyrenees
the compliance dog. Maps the pack's findings to SOC 2, ISO 27001, PCI DSS and OWASP ASVS.
findings.md
12## Access control
13- Admin panel has no MFA- Admin MFA → SOC 2 CC6.1 · ISO 27001 A.8.5 · fix before audit
14- Sessions last 30 days
15- No access review process
16
Fails SOC 2 CC6.1
ExploitThe auditor will flag this control
FixSmallest change suggested
Pyrenees is watching$ /watchdog-go-compliance0 found · 0 fixed
What it does
On duty while you build.
The compliance dog. Maps findings from every Watchdog dog to SOC 2, ISO 27001, PCI DSS and OWASP ASVS, and lists the evidence an auditor will ask for.
The always-on lens watches SOC 2, ISO 27001, PCI DSS, ASVS, audits, controls, evidence, security questionnaires.
What it checks
6 things Pyrenees looks for.
Map to controls
each finding to the framework controls it breaks (e.g. SOC 2 CC6.1, ISO 27001 A.8.24, PCI DSS 3.5, ASVS V2).
Gaps
controls with no evidence in the repo (logging, access reviews, backups, incident process).
Evidence list
what to show an auditor: configs, policies, screenshots, tickets, with file paths.
Questionnaires
draft answers from the code and config, marked where a human must confirm.
Honesty
never claim compliance; state coverage and what is unverified.
Commands
Send Pyrenees out.
Map the pack's findings to SOC 2, ISO 27001, PCI DSS, OWASP ASVS
Benchmark
Tested, not promised.
Its test target holds a SaaS snapshot plus findings.md from other dogs: 18 planted compliance gaps, 3 decoys and an answer key.
gaps
Haiku 5.517/18
Sonnet 5.518/18
Opus 5.516/18
Rules of engagement
What Pyrenees will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Pyrenees, answered.
What does Pyrenees check for?
Pyrenees is Watchdog's compliance dog for Claude Code. It looks for Collect findings, Map to controls, Gaps, Evidence list, Questionnaires and Honesty. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Pyrenees in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-compliance. Its lens also stays on while you code and flags risky lines as they're written.
Is Pyrenees safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).