changelog

Dependency validation now checks whether a known dependency vulnerability affects your application and whether the proposed update fixes it, directly on Dependabot and Renovate security pull requests.

Superagent runs your application in an isolated sandbox and attempts to reproduce the vulnerability at the PR's base commit. When an exploit is confirmed, it repeats the reproduction against the updated application and checks that the relevant functionality still works. A fix is verified only when the update blocks the demonstrated attack and the application remains healthy.

Results appear as a Superagent · Dependency Validation GitHub check and a PR comment with application-specific impact, advisory details, and a link to the full investigation. Superagent can also establish that a vulnerability does not apply to your app. Missing setup or insufficient evidence produces an inconclusive result; an unsuccessful exploit attempt alone does not establish that your app is unaffected.

To get started, an organization owner can open a repository's Dependency validation tab and enable Verify vulnerable dependency updates. Add application setup instructions to the repository and required variables to its Environment tab. You can also restrict target branches and set a maximum number of runs per pull request.

Dependency validation replaces scheduled Secure Dependency Updates. Dependabot or Renovate manages update PRs, and Superagent verifies them. The check is off by default and must be enabled explicitly.

Existing branch protection rules remain supported: Superagent also publishes the same result under the former Superagent · Dependency Red Team check name. You can switch required checks to Superagent · Dependency Validation in GitHub.

Learn more in the Dependency Red Team guide.

Red-team reports now show Completed when review is finished. After a successful scan, reports with findings move to In Review. Resolve every finding as Fixed, Accepted risk, False positive, or Won’t fix, and the report completes automatically. Successful scans with no findings complete immediately.

The Status dropdown in the report sidebar lets you mark a review Completed manually, even with unresolved findings, or return it to In Review. The current status stays visible as a colored badge alongside the other sidebar fields.

The same manual override is available through the Reports API and the MCP tool update_report_review_status. You can also filter reports by Completed through either interface.

New or reopened unresolved findings automatically move a finished report back to In Review. This works across repository, application, package, and agent red-team reports, so the report status follows the work still needing a decision.

Learn more in the Red Teaming guide.

You can now control which pull requests get scanned and how often from each repository's settings. PR security and supply chain scans have independent controls, so you can tailor coverage to each workflow.

Under either scan type, select the base branches you want to scan. Leave the selection empty to scan pull requests targeting any branch. Set a maximum number of runs per pull request to limit scans across new commits and requested reruns, or leave it blank for unlimited runs. Existing scan attempts count toward a newly configured limit.

Changes save automatically: branch selections take effect immediately, and run limits save when you leave the field or press Enter. The settings apply to future scan attempts; supply chain limits also apply to verified dependency updates.

Learn more in the PR security scanning and supply chain scanning guides.

Security-One 27B is now available through the Security-One API as security-one, or as Apache 2.0 open weights.

What it does

Classify prompts, agent tool calls, code changes, and alerts with probabilities instead of free-form text. Use it as a first pass and route suspicious or ambiguous events to a stronger model or human review. Your code owns the thresholds and actions.

Prompt-injection results

On our frozen binary BIPIA evaluation at a 0.70 unsafe-probability threshold, Security-One detected 599 of 600 attacks and flagged 1 of 200 benign inputs. It flags more difficult benign inputs on NotInject. Tune thresholds on your own traffic and keep deterministic controls in place.

Read the launch post for comparisons, or see the model details and limitations.

Get started

Try the prompt-injection example, or follow the self-hosting recipe to run the open weights yourself.

Superagent is now listed on the Cursor Marketplace. Install it with one click to bring security findings, red-team reports, and guardrails into Cursor.

What you get

The listing bundles guidance for working with Superagent from your coding agent:

• Context Guardrails at coding-agent tool boundaries, so files, pages, packages, skills, and messages are scored before agents trust them.
• Remote MCP server configuration for https://www.superagent.sh/mcp, so Cursor can list findings, retrieve reports, start security work, and return structured agent reports.
• Signed webhooks for findings, security reports, Contributor Trust, and Runtime Guardrails, so events reach your Cursor automations and workflows.

Install it

Open the Superagent listing and choose Add to Cursor, then authenticate with a Superagent organization API key stored as SUPERAGENT_API_KEY. The key is sent as a bearer token and is never pasted into chat or committed to source control.

Once connected, ask Cursor to work the security queue in plain language — list unresolved findings, explain a finding's root cause, or check whether the latest report finished.

Connect Cursor to Superagent and read the MCP documentation for the full tool reference.

You can now send Superagent security events to Datadog, Grafana Cloud, or your own OpenTelemetry Collector. Open Telemetry in the sidebar to configure destinations for your organization.

Choose the report, finding, agent, contributor trust, and dependency update events you want to receive, then filter by source group. Each event is exported as a structured OpenTelemetry log with the same event data available through webhooks.

Destinations support HTTP / Protobuf and HTTP / JSON, encrypted authentication headers, and a test event to verify your connection. Pause or edit a destination at any time. Delivery runs asynchronously and retries transient failures automatically.

Read the telemetry setup and event reference.

PR Scanning now shows live progress in GitHub checks while a scan runs. Instead of a generic in-progress state, the check displays the current stage and percentage as Superagent prepares the PR, reviews its changes, saves findings, and publishes results. Supply chain checks also show progress as they analyze changed dependencies.

Security findings now require a concrete, changed attacker path before they are published. If a candidate cannot be verified, the scan calls for manual review rather than presenting an unverified claim as a finding or marking the PR clean.

Superagent also carries relevant feedback from previously reviewed finding threads into future scans. Dismissals are not automatically treated as false positives: the scan considers reviewer replies and checks the current change independently before reporting a similar issue again.

Read the PR Scanning documentation.

Secure Dependency Updates now lets you choose what each scheduled run covers.

Open a repository in Superagent and pick a Scope under Secure Dependency Updates. Vulnerabilities remediates open GitHub Dependabot alerts, including transitive dependencies, and is the default. Version updates proposes available updates for direct dependencies. All updates remediates vulnerabilities first, then proposes direct version updates.

Vulnerability scopes require the Superagent Security GitHub App to have Dependabot alerts: Read-only permission for the repository.

Read the Dependency Validation documentation.

Secure Dependency Updates now finds available dependency versions and proposes the resulting manifest and lockfile changes as pull requests.

Open a repository in Superagent and choose a daily, weekly, or monthly schedule under Secure Dependency Updates. Superagent runs pinned Dependabot tooling in an isolated sandbox, evaluates supported package changes, and publishes only proposals that satisfy supply chain policy. Updates with a blocking risk are withheld before a pull request is opened.

Read the Dependency Validation documentation.

Repository owners can now give additional GitHub users and bots permission to request PR security reviews and dismiss findings.

Open a repository in Superagent and add an exact GitHub login under PR Security Scan. This lets automations such as github-actions[bot] comment @superagent review to start a scan, even when automatic PR security scans are deactivated.

Pull request authors and repository members with write, maintain, or admin access keep their existing permissions. Superagent's own bots remain blocked to prevent review loops.

Context Guardrails now scores inbound SMS and WhatsApp messages.

Submit text from Agents → Context, POST /api/v1/context/message, or the MCP tool scan_message. Superagent checks message text and outbound HTTPS links for phishing, prompt injection, and social engineering. Media and attachments are not scanned.

Read the Messages documentation.

Public repositories can now show Superagent security badges in their README.

Open Repository → Badges, pick a repo, choose an accent and theme, then copy the snippet. The shield sits in the badge row. The card shows pull request coverage, pull requests scanned, and consecutive days of coverage.

Badges never disclose open findings or trust scores. Private repositories stay unpublished.

Context Guardrails can now score a registry package before an agent installs it.

Submit npm:lodash@4.17.21 from Agents → Context, POST /api/v1/context/package, or the MCP tool scan_package. Superagent runs the same managed supply chain pipeline used on pull request dependency changes: package intelligence, alerts, and an LLM risk assessment mapped to identity, behavior, and content scores.

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed instead of returning a safe result. Pull request supply chain scanning is unchanged and still runs automatically when a supported lockfile changes.

Read the Context Guardrails documentation.

Runtime Guardrails decide what an agent may do. Context Guardrails decide what an agent may consume.

Agents fetch pages, open files, install skills, and connect MCP servers without reviewing any of it. Superagent now scores that untrusted context first, so agents keep full capability without inheriting hostile input.

Identity, behavior, and content

Every scan returns a score from 0 to 100, a verdict of safe, caution, suspicious, or dangerous, and a confidence level. The score combines three dimensions: who published it, how it behaves, and what is actually in it. Cached results are reused across organizations.

Five origins, available now

• Web pages — domain identity, redirect chains, hidden DOM, and rendered page text. New lookups return a preliminary identity score immediately and finish the deep scan in the background.
• Email — sender authentication, phishing and injection patterns, attachments, and outbound links.
• Files — public text and PDFs, with type consistency, encoded instructions, and prompt injection checks. File bytes are never stored.
• Agent skills — GitHub publisher identity, requested capabilities, hidden instructions, and install hooks. Skill files are treated as untrusted data and are never executed.
• MCP repositories — static review of public GitHub MCP servers, including tool descriptions, schemas, instructions, hooks, and secrets. Superagent never connects to a live MCP endpoint or runs the server.

Full repositories remain covered by repository red teaming. On-demand registry package scores shipped later; see Package scans in Context Guardrails. Pull request supply-chain scanning is unchanged.

Dashboard, API, and MCP

Open Agents → Context to submit a target and inspect subscores, tiers, and threats. The same scans are available through the REST API and matching MCP tools: get_context_score, scan_email, scan_file, scan_skill, and scan_mcp.

Read the Context Guardrails documentation.

Contributor Trust is now available through the organization REST API and the Superagent MCP server, so security agents and internal workflows can assess GitHub contributors without using the dashboard.

Read cached trust

GET /api/v1/contributors/{login}/trust returns the latest globally cached Contributor Trust result for any GitHub login. Any valid organization API key can read a cached result; the contributor does not need prior activity in that organization.

Start and track scans

POST /api/v1/contributors/{login}/trust-scans starts an asynchronous scan for your organization. Poll with GET /api/v1/contributor-trust-scans/{scan_id}, or subscribe to the contributor_trust.finished webhook for the terminal result.

Starting a scan requires an active Superagent GitHub App installation and an enabled webhook subscribed to contributor_trust.finished.

Same operations over MCP

The Superagent MCP server exposes matching tools:

• get_contributor_trust — retrieve the cached result
• scan_contributor_trust — start a scan
• get_contributor_trust_scan — check scan status

Ask Cursor, Claude Code, or Codex CLI in plain language: "Show the latest Contributor Trust result for octocat" or "Scan contributor octocat, then check the scan status."

Read the Contributor Trust API and MCP documentation to get started.

Superagent Red Teaming now supports Package reports: black-box assessments of installable software.

Give Superagent installation instructions such as brew install foo, npm i -g bar, or a short multi-step setup. Optionally add a specific prompt to steer the campaign. Superagent provisions an isolated sandbox, follows the instructions, discovers the local attack surface, and reports verified security-boundary failures with reproduction steps.

Create Package reports from Red team → New report, through POST /api/v1/reports/package, or with the MCP tool create_package_report.

Read the Package reports documentation to get started.

Stop catastrophic actions

Coding agents run with your permissions. One bad command should not be able to delete your home directory—or your whole computer.

Superagent now monitors agent activity locally and enforces rules before actions run. Built-in guardrails block catastrophic behavior such as recursive deletion, destructive disk operations, fork bombs, and mass process termination. Other rules can monitor without blocking.

Your rules, your response

Create your own policies and send signed detection or enforcement events to your systems through webhooks, so your team controls what happens next.

One layer across coding agents

The same guardrails work across 26 coding agents, including Claude Code, Codex, Cursor, Gemini CLI, Windsurf, GitHub Copilot, OpenCode, Devin, Cline, and OpenHands.

Set up agent monitoring.

Superagent can now red-team deployed AI agents through two purpose-built modes: GrayBox API testing for structured endpoints and BlackBox browser testing for live user experiences.

GrayBox API testing

Give Superagent the authorized endpoint, request contract, and scoped credentials for your agent. The runner tests HTTP, streaming, and WebSocket interfaces directly, preserves redacted request and response evidence, and resets sessions between independent attacks.

Because the runner understands the expected method, payload shape, prompt location, and response format, it can explore multi-turn behavior and security boundaries without needing source-code access.

BlackBox browser testing

Point Superagent at the browser experience your users see. The runner works through the live interface like an external attacker, discovering authentication, sessions, uploads, memory, approvals, tool use, and external actions before selecting target-specific attacks.

Optional test credentials and encrypted headers support authenticated or staging environments while keeping the assessment scoped to the configured target.

Framework-complete coverage

Every assessment researches the current authoritative versions and builds a mandatory coverage matrix across:

• OWASP LLM Top 10 — every category is tested or explicitly dispositioned
• OWASP Agentic Top 10 — from agent goal hijacking and tool misuse to memory poisoning, cascading failures, and rogue agents
• MITRE ATLAS — Generative AI and Agentic AI techniques, plus other techniques when the discovered capabilities make them applicable
• AIUC-1 — applicable technical requirements across Data & Privacy, Security, Safety, Reliability, Accountability, and Society

NIST guidance, provider documentation, academic research, conference work, and recent disclosures supplement the required frameworks with new target- and model-specific attack patterns.

Evidence, not checkboxes

Each framework item is marked tested, not applicable, or blocked, with target-specific rationale, controls, attack variants, and evidence. Confirmed findings include reproduction steps, impact, remediation guidance, false-positive analysis, and mappings back to the relevant framework identifiers.

Read the Agent reports documentation to start an assessment from the dashboard, REST API, or MCP.

Contributor Credit Score v2 makes deterministic GitHub evidence the source of the published trust score.

Explainable account signals

Profiles now show positive evidence, concerns, contextual observations, and unavailable sources across account history, contribution patterns, repository originality, public identity, commit verification, and pull-request outcomes.

Evidence-aware confidence

Missing GitHub data no longer behaves like a zero-value signal. The score records evidence coverage and becomes inconclusive when core account evidence cannot be collected.

One-way history review

Sandboxed patch review remains a safety layer. Concrete suspicious historical patches can lower a contributor's score, while clean or incomplete history review cannot inflate the deterministic result.

Superagent now scans dependency changes in pull requests for supply chain risks before they reach your default branch.

A dedicated pull request check

The new Superagent Supply Chain Scan runs alongside the existing security scan whenever a supported manifest, lockfile, or GitHub Actions workflow changes. It compares the pull request with its base commit and analyzes only added or upgraded dependency versions.

Findings where you review code

Actionable risks appear as inline review comments on the changed dependency line. Related signals are grouped into one issue per dependency, keeping the review focused while preserving the full rule-level evidence in the check details.

Merge protection that clears when fixed

The check fails when Superagent finds an actionable supply chain issue. Remove or replace the risky dependency and push a new commit to rerun the scan; once no actionable dependency changes remain, the check passes automatically.

Repository owners can deactivate supply chain scans at any time from the repository detail page.

Superagent now exposes its REST API as a remote Model Context Protocol server, so an AI coding agent can read findings, inspect reports, and start new security work without you writing any integration code.

What you can do

Ask your agent to work the security queue in plain language:

• Start red-team reports against a connected repository or a public Web app, then check on progress.
• Manage findings — list and retrieve them, update triage state, trigger automated triage, or delete them.
• Review reports — list and retrieve repository and Web app reports and see whether the latest run finished.

Every /api/v1 operation is available as a tool, and responses include both readable text and structured JSON.

One command to connect

Point Cursor, Claude Code, or Codex CLI at https://www.superagent.sh/mcp and authenticate with the same organization API keys you already use for the REST API. No OAuth flow to set up — the key is the credential.

claude mcp add --transport http --scope user superagent \
  https://www.superagent.sh/mcp \
  -H "Authorization: Bearer sk_live_..."

Read the MCP documentation to connect your client.

Superagent can now connect directly to your internal agents, ticketing systems, and security workflows through organization webhooks and a versioned REST API.

Organization API keys

Create and revoke API keys from Settings, then use Bearer authentication to access resources scoped to your organization.

Reports and findings API

The new /api/v1 endpoints can start repository and Web app security reports, list and retrieve findings, update finding status, and trigger automated triage. Finding responses include report, triage, evidence, and remediation context so external tools can act without scraping the dashboard.

Signed lifecycle webhooks

Subscribe endpoints to report and finding lifecycle events. report.started confirms that a repository or Web app report was accepted, while report.finished closes the loop when execution enters review or fails. Finding events cover new findings, completed triage, and accepted risks.

End-to-end automation

Use signed webhook payloads to orchestrate work around the API without polling. Deliveries include safe report status or structured remediation context, retry transient failures automatically, and can be configured, tested, rotated, or disabled from Settings.

Read the API documentation and webhook guide to get started.

Superagent now gives findings a more focused workspace for reviewing, prioritizing, and resolving security work.

Kanban triage

Findings are organized into a board so teams can move issues from new to review to resolved without losing context.

Severity and repository grouping

The board can group findings by severity, repository, or both, making it easier to see the riskiest work and route it to the right owners.

Qualifier search

Search now supports free text plus qualifiers like status, risk, source, resolution, and repo, with active findings shown by default.

Superagent now gives teams a dedicated notifications feed for important security and contributor activity.

Activity inbox

The new feed groups notifications by day and starts with unread updates so teams can quickly catch up.

Finding and contributor context

Notifications include context for findings, repositories, contributors, and pull requests so each update is easier to act on.

Email preferences

Users can choose which notification types should also be delivered by email.

Sidebar visibility

Unread counts now appear in the app sidebar, keeping important updates visible while teams work.

Superagent now reviews more contributor history before assigning trust, with deeper PR evidence and faster cached checks.

Broader history evidence

The scan ranks recent authored pull requests by risk and hydrates the most useful examples with patch and review context.

Parallel sandbox investigators

Larger contributor histories can be split across isolated investigators, then merged into one contributor verdict.

Patch-level safety guardrails

Safe results now require concrete patch-level evidence, with weak or metadata-only reviews downgraded automatically.

Faster checks for active contributors

Contributor trust scans are cached and warmed after PR activity so follow-up checks are faster.

Superagent now gives security and platform teams a deeper way to understand who is contributing code. Deep Contributor Credit Score analyzes contributor history, repository context, and patch-level evidence to produce an explainable trust signal before a pull request reaches production.

Hydrated contributor history

The score reviews hydrated historical pull requests for the contributor, looking across performance optimization work, cross-repository patterns, internal product features, safety infrastructure, and other high-signal code paths. This gives reviewers more context than the current diff alone can provide.

Explainable trust signals

Each score includes the evidence behind the result: CLA status, last activity, organization alignment, issue linkage, omitted evidence, and confidence levels for patch-level review. Teams can see why a contributor is trusted, suspicious, or needs additional review without reverse-engineering a black-box verdict.

Patch-level safety review

Contributor scoring is combined with patch-level inspection for risky behavior such as credential access, hidden network calls, dependency abuse, permission broadening, or suspicious code paths. The result is a focused review workflow that helps teams distinguish trusted collaboration from changes that need deeper investigation.

Superagent now meets your team where work already happens: on GitHub. This release connects repository configuration, automated adversarial testing, CLA management, and advisory triage into a single workflow, so you can ship faster without trading off security review.

Configure repositories

Choose which repositories Superagent protects, set scan and policy preferences per repo, and keep ownership clear across your organization. Onboarding is straightforward: connect GitHub, pick the repos that matter, and your team gets a consistent baseline before code or agents reach production.

Adversarial tests on GitHub events

Trigger adversarial tests automatically from GitHub events, such as pull requests and pushes, so risky changes are challenged before they merge. Tests run in the background against your configured policies, surfacing failures and findings where developers already review code.

Create and manage CLAs

Create and manage Contributor License Agreements without leaving Superagent. Define agreement templates, track contributor status, and keep open-source contribution workflows compliant as your projects and policies evolve.

Triage GitHub advisories automatically

Incoming GitHub security advisories are triaged automatically: Superagent assesses severity and relevance, groups related signals, and helps your team focus on what needs action now versus what can wait. Less manual sorting, faster response when a dependency or repo is at risk.