Get Started
Superagent is security for AI-native developers: checks on every pull request, red teaming for your apps and agents, and guardrails for what agents do and consume at runtime.
You already work in your coding agent and GitHub, so that is where Superagent works too. It checks every pull request before it merges, red-teams your app, repo, and agents before they ship, and puts guardrails around what your agents do and everything they consume. Free for open source.
Products
Trust the change: checks on every pull request, before merge.
| Product | What it does |
|---|---|
| PR Scans | Vulnerability checks on every pull request, with findings on the exact line and fixes as pull requests |
| Contributor Trust | Know who is behind the code before it merges |
| Agreements | CLA templates, versions, and signing workflows |
Break it before it ships: self-serve red teaming against what you actually run.
| Product | What it does |
|---|---|
| Red Team | Adversarial tests on your app, repo, and agents. Every finding ships with repro steps and the payload that worked |
Control it where it runs: deterministic rules for what agents do, trust scores for everything they consume.
| Product | What it does |
|---|---|
| Runtime Guardrails | Monitor coding agents and block risky actions with endpoint-local security rules |
| Context Guardrails | Score files, URLs, packages, MCP servers, skills, and email before agents consume them |
Across all of it, Findings is the one triage queue for every security issue Superagent raises.
Get started
Three steps, no new habits:
- Create your account to connect repos, manage keys, and invite your team.
- Connect to GitHub to keep your repos secure.
- Add the MCP server to red-team your code and agents from your coding agent.
Follow the Quickstart to get through all three, then install the GitHub Apps on the repositories you want covered.
The dashboard
The app at /app is organized around a single sidebar:
| Item | Path | What it is for |
|---|---|---|
| Dashboard | /app |
Onboarding checklist and org activity |
| Repository | /app/repository |
Connected repos and per-repo settings |
| Red team | /app/reports |
Every report, across all four target types |
| Findings | /app/findings |
Org-wide triage queue |
| Contributors | /app/contributors |
Contributor profiles with trust and CLA status |
| Agreements | /app/agreements |
CLA templates and versions |
| Integrations | /app/integrations |
GitHub App installs and Dropbox Sign |
| Settings | /app/settings |
Org profile, members, API keys, and webhooks |
Use the organization switcher in the sidebar to move between orgs. Repositories, reports, findings, and agreements are scoped to the selected organization.
Build on Superagent
- MCP server: connect Cursor, Claude Code, or Codex CLI and work with findings and reports from your coding agent.
- REST API: create reports, manage findings, and trigger triage over
/api/v1. - Webhooks: send report, finding, and agent monitoring events to your own systems.