// products
PR Scanning
PR Scanning brings four checks into pull request review. Each check answers a different question before merge.
Four checks, four decisions
| Check | Pull request question | GitHub check |
|---|---|---|
| Security scanning | Does the diff introduce vulnerable or malicious code? | Superagent Security Scan |
| Supply chain scanning | Are added or upgraded packages safe? | Superagent Supply Chain Scan |
| Contributor Trust | Does the contributor's identity and history indicate risk? | Contributor trust |
| Contributor Agreements | Has every contributor signed the required agreement? | Contributor License Agreement |
The checks run independently and can be required through branch protection. Security scanning and supply chain scanning are enabled by default on connected repositories. Contributor Trust is enabled by default for public repositories and disabled by default for private repositories. Contributor Agreements runs after you install Open CLA from Integrations and assign an agreement to the repository.
Set up PR Scanning
Install the Superagent Security GitHub App through Connect GitHub for security scanning, supply chain scanning, and Contributor Trust. Install Open CLA separately for Contributor Agreements. Configure each check from the repository page in the Superagent dashboard.
Where results appear
On GitHub, every check completes as its own check run. Security and supply chain findings also appear as inline review comments on the relevant line. Failed or action-required checks block merge when branch protection requires them.
In the dashboard, the repository detail page (/app/repository/[repositoryId]) lists recent pull request checks for the repo, next to the per-repo scan settings.
From finding to fix
Findings that need deeper work land in the Findings queue, where automated triage verifies them and one click turns a confirmed finding into a ready-to-review fix PR.
Structured agent reports
Route qualifying findings to a customer coding agent. The agent can remediate the branch and return a structured agent report through Superagent MCP. Superagent retains the report as context for later repository and supply-chain work.
Repositories can also enable Dependency Validation in repository settings to test known vulnerabilities and verify fixes on Dependabot and Renovate security pull requests.