Agent reports

Agent reports perform automated black-box adversarial testing against a deployed AI agent. They discover capabilities, exercise relevant attack hypotheses, preserve evidence, and report verified security-boundary failures without requiring source-code access.

Create and configure an Agent

Open Agents → Connected and select Add new.
Enter a name and select an agent type.
Optionally associate a connected repository.
For Coding Agents, copy the one-time Runtime Guardrails pairing command.
Open the Agent detail page and enable Red teaming.
Configure the Web app or API target, credentials, headers, throttle, schedule, and optional specific prompt.
Select New run, or allow the daily, weekly, or monthly schedule to start it.

Each run is linked to the persistent Agent. Manual, scheduled, and API-triggered
runs appear together on the Agent detail page and retain their full report
detail.

Web app targets

Use Web app when the AI agent is accessed through a browser interface. Superagent generates test credentials that you can view, edit, or copy before starting the report. You can also add encrypted headers for staging gates, tenant selection, or authentication.

The isolated runner interacts only with the configured origin. Browser interaction evidence can appear in the Evidence tab when recording is available.

API targets

Use API when the AI agent is exposed through an HTTP or WebSocket endpoint. Enter only the endpoint URL. Add authentication or tenant headers under Headers.

Describe the API contract in Specific prompt, including:

HTTP method and example JSON payload
Where the attack prompt belongs
Required model or deployment identifier
Expected response or streaming shape

For example:

POST JSON like:
{
  "model": "qwen/qwen3.7-flash",
  "stream": false,
  "messages": [
    { "role": "system", "content": "You are a helpful assistant." },
    { "role": "user", "content": "<attack prompt>" }
  ]
}

API reports expose Logs and Findings. They do not show browser evidence.

REST API and MCP

Programmatic clients can create either modality with:

POST /api/v1/agents and PATCH /api/v1/agents/{agent_id}
MCP tools create_agent and update_agent
POST /api/v1/reports/agent
MCP tool create_agent_report

Use the Agent endpoints for reusable identity and scheduled configuration. Use
the report endpoint for an ad hoc run. See the Agents API
and Reports API.

The agent detail page

Each automated Agent report lives at /app/reports/agent/[id]. From there you can:

Follow expandable runner logs
Review findings and risk counts
Inspect target, assignees, cost, and runtime status
Delete or rerun the report
Review browser evidence for Web app targets

Best practices