superagent_

// get started

Install GitHub Apps

Install Superagent Security and Open CLA on the repositories you choose to enable PR scans, contributor trust, red-team reports, and CLA checks.

Superagent gets GitHub access through GitHub Apps installed on the repositories you choose, not through a broad OAuth token. Install each app only on the repos Superagent should scan, test, or govern.

The two apps

App Install URL What it enables
Superagent Security github.com/apps/superagent-security PR security scans, supply chain scans, contributor trust, repository red-team reports, GitHub advisory ingestion
Open CLA github.com/apps/open-cla CLA checks on pull requests, contributor signing, per-repo CLA enforcement

You can install one or both apps on the same repositories.

Install an app

  1. Sign in to the Superagent dashboard and open Integrations.
  2. Select the app that matches your workflow. GitHub opens the installation flow.
  3. Install on the organization or account that owns your repositories.
  4. Choose Only select repositories and pick the repos Superagent should access. Select all repositories only if you intentionally want every repo covered.
  5. GitHub redirects you back to Superagent when the install completes.

After connecting:

  • Open Integrations and confirm each app shows as connected.
  • Open Repository and verify your repos appear with the expected capability badges: Security, CLA, or both.
  • Open or update a pull request on a connected repo to see the first checks run.

You can change repository access later by reconfiguring the app in GitHub or from Integrations.

Superagent Security

Install Superagent Security when you need:

  • Security scan and Contributor trust checks on pull requests
  • Superagent Supply Chain Scan checks for changed dependencies
  • Repository red-team reports on connected repos, including private repo clone access for scans
  • GitHub repository security advisories surfaced as findings

The app needs repository access for checks, pull request events, comments, and labels. Advisory triage uses repository_advisory webhook events.

Open CLA

Install Open CLA when you need:

  • The Contributor License Agreement check on pull requests
  • Contributor signing, in-app or via Dropbox Sign
  • Per-repository CLA template assignment

Open CLA needs repository access for CLA file reads, pull request checks, and signing comments. Organization membership read access is required for corporate CLA coverage. See How CLA checks work.

Next steps