superagent_

// your integrations

Connect GitHub

[ view markdown ]

Install the Superagent GitHub Apps, select repositories, and run the first repository security job.

Superagent gets GitHub access through GitHub Apps installed on the repositories you choose, not through a broad OAuth token. Install each app only on the repos Superagent should scan, test, or govern.

The two apps

App What it enables
Superagent Security PR security scans, supply chain scans, contributor trust, repository red-team reports, GitHub advisory ingestion
Open CLA CLA checks on pull requests, contributor signing, per-repo CLA enforcement

You can install one or both apps on the same repositories.

Install an app

  1. Sign in to the Superagent dashboard and open Integrations.
  2. Select the app that matches your workflow. GitHub opens the installation flow.
  3. Install on the organization or account that owns your repositories.
  4. Choose Only select repositories and pick the repos Superagent should access. Select all repositories only if you intentionally want every repo covered.
  5. GitHub redirects you back to Superagent when the install completes.

After connecting:

  • Open Integrations and confirm each app shows as connected.
  • Open Repository and verify your repos appear with the expected capability badges: Security, CLA, or both.
  • Open or update a pull request on a connected repo to see the first checks run.

You can change repository access later by reconfiguring the app in GitHub or from Integrations.

Superagent Security

Install Superagent Security when you need:

  • Security scan checks on pull requests, plus Contributor trust (on by default for public repos, off for private repos)
  • Superagent Supply Chain Scan checks for changed dependencies
  • Repository red-team reports on connected repos, including private repo clone access for scans
  • GitHub repository security advisories surfaced as findings

The app needs repository access for checks, pull request events, comments, and labels. Advisory triage uses repository_advisory webhook events and is on by default for public repositories only.

Open CLA

Install Open CLA when you need:

  • The Contributor License Agreement check on pull requests
  • Contributor signing, in-app or via Dropbox Sign
  • Per-repository CLA template assignment

Open CLA needs repository access for CLA file reads, pull request checks, and signing comments. Organization membership read access is required for corporate CLA coverage. See Contributor Agreements.

Next steps