superagent_

// red team

Package reports

Install a package in a sandbox and try to break it.

Package reports perform automated black-box adversarial testing against installable software. You supply installation instructions; Superagent provisions an isolated sandbox, follows those instructions, discovers the local attack surface, and tries to breach the installed package.

Create a package report

  1. Open Red team and select New report, or go to /app/reports/new.
  2. Choose Package.
  3. Enter Installation instructions (required): how to install and, if needed, start the package.
  4. Optionally add a Specific prompt to steer the campaign.
  5. Submit to provision the isolated runner and open the live detail page.

Examples of installation instructions:

brew install foo
npm i -g bar@1.2.3
bar --serve --port 8080
pip install baz==1.0.0
baz serve --host 127.0.0.1

Package reports created in the dashboard are labeled Manual in the report list. Reports created through REST or MCP are labeled API.

What the runner does

In the sandbox, Superagent:

  1. Follows your installation instructions
  2. Discovers local surfaces such as CLIs, local ports, config files, and privilege boundaries
  3. Runs adaptive attacks against those surfaces
  4. Emits findings with reproduction steps and evidence

The install instructions and any specific prompt are treated as untrusted input and execute only inside the isolated sandbox. Organization secrets are not injected.

REST API and MCP

Programmatic clients can create Package reports with:

  • POST /api/v1/reports/package
  • MCP tool create_package_report

Both accept installation_instructions (required) and custom_goal_prompt (optional). See the Reports API for request fields and examples.

The package detail page

Each Package report lives at /app/reports/package/[id]. From there you can:

  • Follow expandable runner logs
  • Review findings and risk counts
  • Inspect installation instructions, optional prompt, cost, and runtime status
  • Delete or rerun the report

Findings also appear in the shared Findings queue.

Next steps