Any customer agent can participate in the security factory when it can receive a signed finding, use Superagent MCP, act within a defined scope, and return a structured agent report.

Connection contract

1. Store a dedicated Superagent API key in the agent environment.
2. Connect https://www.superagent.sh/mcp with bearer authentication.
3. Configure a signed Superagent webhook for finding delivery.
4. Verify and deduplicate events before starting work.
5. Retrieve current finding context through Superagent MCP.
6. Investigate, remediate, or record a disposition.
7. Return a structured agent report through Superagent MCP.
8. Confirm that Superagent retained the report.
9. Require human approval for consequential changes.

Client-specific configuration

Use the MCP client's documented Streamable HTTP configuration. Keep the Superagent API key in the client's secret storage or environment. Keep third-party credentials at the receiving agent or relay rather than sending them as Superagent webhook headers.

Verify the integration

Send one webhook test event, confirm one agent task starts, read the matching finding through MCP, return a structured agent report, and confirm that the report appears in Superagent customer context.

Next steps

• Use Superagent MCP
• Subscribe to events with Webhooks
• Understand findings and reports