superagent_

// security workers

Repositories

[ view markdown ]

A repository Red Team run points a security agent at your codebase. The agent clones the repo into an isolated sandbox, chains findings together the way an attacker builds a kill chain, and records exploit paths with repro steps in the red-team report. Because the run uses the full repo as context, this is the gray-box option: it sees your code, not just your public surface.

When the repository exposes a Web or network service that can run in the sandbox, Prime can use the upstream FuzzingLabs Nuclei MCP server against that live service. Nuclei results remain candidates until Prime reproduces them and connects them to repository evidence.

Start a repository run

  1. Open Red team and select New report, or go to /app/reports/new.
  2. Choose Repository.
  3. Select one or more repositories from the repos where Superagent Security is installed.
  4. Optionally add a goal prompt to focus the engagement, then submit.

Private repositories require the security app with repository contents access. Beyond manual creation, repository runs can trigger automatically on a GitHub release, a tag, or a schedule.

Configure recurring runs

  1. Open Repository and select a connected repository.
  2. Enable Red teaming in its settings.
  3. Choose releases, prereleases, release tags, or a daily, weekly, or monthly schedule.
  4. Add a repository-specific goal when the campaign needs a narrower scope.
  5. Select New run once to confirm repository access and the goal before relying on the trigger.

The report detail page

Repository red-team reports open at /app/reports/repository/[id]. The detail view includes:

  • Run status and the live agent event feed
  • Linked findings discovered during the run, each with repro context
  • Assignees and status updates for your team's review workflow
  • Cost and timing for the engagement

Findings

Discovered issues land in the Findings queue as repository_red_team findings. From there you can run automated triage to verify exploitability and turn confirmed issues into fix PRs.

Relationship to PR scans

Repository Red Team uses the same GitHub App installation as PR Security. PR scans check every pull request before merge; Red Team runs are deeper engagements you start on demand or on a trigger.

Next steps