Get Started
Superagent is security for AI-native developers: checks on every pull request, red teaming for your apps and agents, and guardrails for what agents do and consume at runtime.
You already work in your coding agent and GitHub, so that is where Superagent works too. It checks every pull request before it merges, red-teams your app, repo, and agents before they ship, and puts guardrails around what your agents do and everything they consume. Free for open source.
Products
Trust the change: checks on every pull request, before merge.
| Product | What it does |
|---|---|
| PR Scans | Vulnerability checks on every pull request, with findings on the exact line and fixes as pull requests |
| Contributor Trust | Know who is behind the code before it merges |
| Agreements | CLA templates, versions, and signing workflows |
Break it before it ships: self-serve red teaming against what you actually run.
| Product | What it does |
|---|---|
| Red Team | Adversarial tests on your app, repo, and agents. Every finding ships with repro steps and the payload that worked |
Control it where it runs: deterministic rules for what agents do, trust scores for everything they consume.
| Product | What it does |
|---|---|
| Runtime Guardrails | Monitor coding agents and block risky actions with endpoint-local security rules |
| Context Guardrails | Score files, URLs, packages, MCP servers, skills, and email before agents consume them |
Across all of it, Findings is the one triage queue for every security issue Superagent raises.
Get started
Three steps, no new habits:
- Create your account to connect repos, manage keys, and invite your team.
- Connect to GitHub to keep your repos secure.
- Connect Superagent to your agent with the Superagent skill, then work with findings, reports, trust, and guardrails from your editor.
Follow the Quickstart to get through all three. Install GitHub Apps covers repository access.
Connect Superagent to your agent
Install the Superagent skill, then ask your coding agent to connect:
npx skills add superagent-ai/skills --skill superagentConnect Superagent to my coding agent.The skill supports Cursor, Claude Code, Codex CLI, and other MCP clients. It guides you through creating a dedicated organization API key, storing it as SUPERAGENT_API_KEY, reviewing the proposed configuration, and verifying the connection. Do not paste the key into chat or commit it to a repository.
Installing the skill does not connect to Superagent or change your configuration. Your agent asks for approval before setup and before actions that cost credits, destroy data, or change Runtime Guardrails policy. For manual configuration and the complete tool reference, see the MCP server guide.
The dashboard
The app at /app is organized around a single sidebar:
| Item | Path | What it is for |
|---|---|---|
| Dashboard | /app |
Onboarding checklist and org activity |
| Repository | /app/repository |
Connected repos and per-repo settings |
| Agents | /app/agents |
Runtime Guardrails. Context Guardrails is at /app/agents/context |
| Red team | /app/reports |
Every report, across all four target types |
| Findings | /app/findings |
Org-wide triage queue |
| Contributors | /app/contributors |
Contributor profiles with trust and CLA status |
| Agreements | /app/agreements |
CLA templates and versions |
| Integrations | /app/integrations |
GitHub App installs and Dropbox Sign |
| Settings | /app/settings |
Org profile, members, API keys, and webhooks |
Use the organization switcher in the sidebar to move between orgs. Repositories, reports, findings, and agreements are scoped to the selected organization.
Build on Superagent
- Connect Superagent to your agent: install the Superagent skill and let your coding agent guide you through a safe MCP setup.
- MCP server: configure Cursor, Claude Code, or Codex CLI manually and work with findings and reports from your coding agent.
- REST API: create reports, manage findings, and trigger triage over
/api/v1. - Webhooks: send report, finding, and agent monitoring events to your own systems.