changelog

Context Guardrails can now score a registry package before an agent installs it.

Submit npm:lodash@4.17.21 from Agents → Context, POST /api/v1/context/package, or the MCP tool scan_package. Superagent runs the same managed supply chain pipeline used on pull request dependency changes: package intelligence, alerts, and an LLM risk assessment mapped to identity, behavior, and content scores.

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed instead of returning a safe result. Pull request supply chain scanning is unchanged and still runs automatically when a supported lockfile changes.

Read the Context Guardrails documentation.

Runtime Guardrails decide what an agent may do. Context Guardrails decide what an agent may consume.

Agents fetch pages, open files, install skills, and connect MCP servers without reviewing any of it. Superagent now scores that untrusted context first, so agents keep full capability without inheriting hostile input.

Identity, behavior, and content

Every scan returns a score from 0 to 100, a verdict of safe, caution, suspicious, or dangerous, and a confidence level. The score combines three dimensions: who published it, how it behaves, and what is actually in it. Cached results are reused across organizations.

Five origins, available now

• Web pages — domain identity, redirect chains, hidden DOM, and rendered page text. New lookups return a preliminary identity score immediately and finish the deep scan in the background.
• Email — sender authentication, phishing and injection patterns, attachments, and outbound links.
• Files — public text and PDFs, with type consistency, encoded instructions, and prompt injection checks. File bytes are never stored.
• Agent skills — GitHub publisher identity, requested capabilities, hidden instructions, and install hooks. Skill files are treated as untrusted data and are never executed.
• MCP repositories — static review of public GitHub MCP servers, including tool descriptions, schemas, instructions, hooks, and secrets. Superagent never connects to a live MCP endpoint or runs the server.

Full repositories remain covered by repository red teaming. On-demand registry package scores shipped later; see Package scans in Context Guardrails. Pull request supply-chain scanning is unchanged.

Dashboard, API, and MCP

Open Agents → Context to submit a target and inspect subscores, tiers, and threats. The same scans are available through the REST API and matching MCP tools: get_context_score, scan_email, scan_file, scan_skill, and scan_mcp.

Read the Context Guardrails documentation.

Contributor Trust is now available through the organization REST API and the Superagent MCP server, so security agents and internal workflows can assess GitHub contributors without using the dashboard.

Read cached trust

GET /api/v1/contributors/{login}/trust returns the latest globally cached Contributor Trust result for any GitHub login. Any valid organization API key can read a cached result; the contributor does not need prior activity in that organization.

Start and track scans

POST /api/v1/contributors/{login}/trust-scans starts an asynchronous scan for your organization. Poll with GET /api/v1/contributor-trust-scans/{scan_id}, or subscribe to the contributor_trust.finished webhook for the terminal result.

Starting a scan requires an active Superagent GitHub App installation and an enabled webhook subscribed to contributor_trust.finished.

Same operations over MCP

The Superagent MCP server exposes matching tools:

• get_contributor_trust — retrieve the cached result
• scan_contributor_trust — start a scan
• get_contributor_trust_scan — check scan status

Ask Cursor, Claude Code, or Codex CLI in plain language: "Show the latest Contributor Trust result for octocat" or "Scan contributor octocat, then check the scan status."

Read the Contributor Trust API and MCP documentation to get started.

Superagent Red Team now supports Package reports: black-box assessments of installable software.

Give Superagent installation instructions such as brew install foo, npm i -g bar, or a short multi-step setup. Optionally add a specific prompt to steer the campaign. Superagent provisions an isolated sandbox, follows the instructions, discovers the local attack surface, and reports verified security-boundary failures with reproduction steps.

Create Package reports from Red team → New report, through POST /api/v1/reports/package, or with the MCP tool create_package_report.

Read the Package reports documentation to get started.

Stop catastrophic actions

Coding agents run with your permissions. One bad command should not be able to delete your home directory—or your whole computer.

Superagent now monitors agent activity locally and enforces rules before actions run. Built-in guardrails block catastrophic behavior such as recursive deletion, destructive disk operations, fork bombs, and mass process termination. Other rules can monitor without blocking.

Your rules, your response

Create your own policies and send signed detection or enforcement events to your systems through webhooks, so your team controls what happens next.

One layer across coding agents

The same guardrails work across 26 coding agents, including Claude Code, Codex, Cursor, Gemini CLI, Windsurf, GitHub Copilot, OpenCode, Devin, Cline, and OpenHands.

Set up agent monitoring.

Superagent can now red-team deployed AI agents through two purpose-built modes: GrayBox API testing for structured endpoints and BlackBox browser testing for live user experiences.

GrayBox API testing

Give Superagent the authorized endpoint, request contract, and scoped credentials for your agent. The runner tests HTTP, streaming, and WebSocket interfaces directly, preserves redacted request and response evidence, and resets sessions between independent attacks.

Because the runner understands the expected method, payload shape, prompt location, and response format, it can explore multi-turn behavior and security boundaries without needing source-code access.

BlackBox browser testing

Point Superagent at the browser experience your users see. The runner works through the live interface like an external attacker, discovering authentication, sessions, uploads, memory, approvals, tool use, and external actions before selecting target-specific attacks.

Optional test credentials and encrypted headers support authenticated or staging environments while keeping the assessment scoped to the configured target.

Framework-complete coverage

Every assessment researches the current authoritative versions and builds a mandatory coverage matrix across:

• OWASP LLM Top 10 — every category is tested or explicitly dispositioned
• OWASP Agentic Top 10 — from agent goal hijacking and tool misuse to memory poisoning, cascading failures, and rogue agents
• MITRE ATLAS — Generative AI and Agentic AI techniques, plus other techniques when the discovered capabilities make them applicable
• AIUC-1 — applicable technical requirements across Data & Privacy, Security, Safety, Reliability, Accountability, and Society

NIST guidance, provider documentation, academic research, conference work, and recent disclosures supplement the required frameworks with new target- and model-specific attack patterns.

Evidence, not checkboxes

Each framework item is marked tested, not applicable, or blocked, with target-specific rationale, controls, attack variants, and evidence. Confirmed findings include reproduction steps, impact, remediation guidance, false-positive analysis, and mappings back to the relevant framework identifiers.

Read the Agent reports documentation to start an assessment from the dashboard, REST API, or MCP.

Contributor Credit Score v2 makes deterministic GitHub evidence the source of the published trust score.

Explainable account signals

Profiles now show positive evidence, concerns, contextual observations, and unavailable sources across account history, contribution patterns, repository originality, public identity, commit verification, and pull-request outcomes.

Evidence-aware confidence

Missing GitHub data no longer behaves like a zero-value signal. The score records evidence coverage and becomes inconclusive when core account evidence cannot be collected.

One-way history review

Sandboxed patch review remains a safety layer. Concrete suspicious historical patches can lower a contributor's score, while clean or incomplete history review cannot inflate the deterministic result.

Superagent now scans dependency changes in pull requests for supply chain risks before they reach your default branch.

A dedicated pull request check

The new Superagent Supply Chain Scan runs alongside the existing security scan whenever a supported manifest, lockfile, or GitHub Actions workflow changes. It compares the pull request with its base commit and analyzes only added or upgraded dependency versions.

Findings where you review code

Actionable risks appear as inline review comments on the changed dependency line. Related signals are grouped into one issue per dependency, keeping the review focused while preserving the full rule-level evidence in the check details.

Merge protection that clears when fixed

The check fails when Superagent finds an actionable supply chain issue. Remove or replace the risky dependency and push a new commit to rerun the scan; once no actionable dependency changes remain, the check passes automatically.

Repository owners can deactivate supply chain scans at any time from the repository detail page.

Superagent now exposes its REST API as a remote Model Context Protocol server, so an AI coding agent can read findings, inspect reports, and start new security work without you writing any integration code.

What you can do

Ask your agent to work the security queue in plain language:

• Start red-team reports against a connected repository or a public Web app, then check on progress.
• Manage findings — list and retrieve them, update triage state, trigger automated triage, or delete them.
• Review reports — list and retrieve repository and Web app reports and see whether the latest run finished.

Every /api/v1 operation is available as a tool, and responses include both readable text and structured JSON.

One command to connect

Point Cursor, Claude Code, or Codex CLI at https://www.superagent.sh/mcp and authenticate with the same organization API keys you already use for the REST API. No OAuth flow to set up — the key is the credential.

claude mcp add --transport http --scope user superagent \
  https://www.superagent.sh/mcp \
  -H "Authorization: Bearer sk_live_..."

Read the MCP documentation to connect your client.

Superagent can now connect directly to your internal agents, ticketing systems, and security workflows through organization webhooks and a versioned REST API.

Organization API keys

Create and revoke API keys from Settings, then use Bearer authentication to access resources scoped to your organization.

Reports and findings API

The new /api/v1 endpoints can start repository and Web app security reports, list and retrieve findings, update finding status, and trigger automated triage. Finding responses include report, triage, evidence, and remediation context so external tools can act without scraping the dashboard.

Signed lifecycle webhooks

Subscribe endpoints to report and finding lifecycle events. report.started confirms that a repository or Web app report was accepted, while report.finished closes the loop when execution enters review or fails. Finding events cover new findings, completed triage, and accepted risks.

End-to-end automation

Use signed webhook payloads to orchestrate work around the API without polling. Deliveries include safe report status or structured remediation context, retry transient failures automatically, and can be configured, tested, rotated, or disabled from Settings.

Read the API documentation and webhook guide to get started.

Superagent now gives findings a more focused workspace for reviewing, prioritizing, and resolving security work.

Kanban triage

Findings are organized into a board so teams can move issues from new to review to resolved without losing context.

Severity and repository grouping

The board can group findings by severity, repository, or both, making it easier to see the riskiest work and route it to the right owners.

Qualifier search

Search now supports free text plus qualifiers like status, risk, source, resolution, and repo, with active findings shown by default.

Superagent now gives teams a dedicated notifications feed for important security and contributor activity.

Activity inbox

The new feed groups notifications by day and starts with unread updates so teams can quickly catch up.

Finding and contributor context

Notifications include context for findings, repositories, contributors, and pull requests so each update is easier to act on.

Email preferences

Users can choose which notification types should also be delivered by email.

Sidebar visibility

Unread counts now appear in the app sidebar, keeping important updates visible while teams work.

Superagent now reviews more contributor history before assigning trust, with deeper PR evidence and faster cached checks.

Broader history evidence

The scan ranks recent authored pull requests by risk and hydrates the most useful examples with patch and review context.

Parallel sandbox investigators

Larger contributor histories can be split across isolated investigators, then merged into one contributor verdict.

Patch-level safety guardrails

Safe results now require concrete patch-level evidence, with weak or metadata-only reviews downgraded automatically.

Faster checks for active contributors

Contributor trust scans are cached and warmed after PR activity so follow-up checks are faster.

Superagent now gives security and platform teams a deeper way to understand who is contributing code. Deep Contributor Credit Score analyzes contributor history, repository context, and patch-level evidence to produce an explainable trust signal before a pull request reaches production.

Hydrated contributor history

The score reviews hydrated historical pull requests for the contributor, looking across performance optimization work, cross-repository patterns, internal product features, safety infrastructure, and other high-signal code paths. This gives reviewers more context than the current diff alone can provide.

Explainable trust signals

Each score includes the evidence behind the result: CLA status, last activity, organization alignment, issue linkage, omitted evidence, and confidence levels for patch-level review. Teams can see why a contributor is trusted, suspicious, or needs additional review without reverse-engineering a black-box verdict.

Patch-level safety review

Contributor scoring is combined with patch-level inspection for risky behavior such as credential access, hidden network calls, dependency abuse, permission broadening, or suspicious code paths. The result is a focused review workflow that helps teams distinguish trusted collaboration from changes that need deeper investigation.

Superagent now meets your team where work already happens: on GitHub. This release connects repository configuration, automated adversarial testing, CLA management, and advisory triage into a single workflow, so you can ship faster without trading off security review.

Configure repositories

Choose which repositories Superagent protects, set scan and policy preferences per repo, and keep ownership clear across your organization. Onboarding is straightforward: connect GitHub, pick the repos that matter, and your team gets a consistent baseline before code or agents reach production.

Adversarial tests on GitHub events

Trigger adversarial tests automatically from GitHub events, such as pull requests and pushes, so risky changes are challenged before they merge. Tests run in the background against your configured policies, surfacing failures and findings where developers already review code.

Create and manage CLAs

Create and manage Contributor License Agreements without leaving Superagent. Define agreement templates, track contributor status, and keep open-source contribution workflows compliant as your projects and policies evolve.

Triage GitHub advisories automatically

Incoming GitHub security advisories are triaged automatically: Superagent assesses severity and relevance, groups related signals, and helps your team focus on what needs action now versus what can wait. Less manual sorting, faster response when a dependency or repo is at risk.