# Superagent

> Superagent is security for AI-native developers: trust what you merge, control what your agents do, and show your users it's safe. PR Scans, Secure Dependency Updates, Contributor Trust, Runtime Guardrails, Context Guardrails, Red Team, and Security Factory. Security checks on every pull request with fixes shipped as pull requests, scheduled dependency updates evaluated before they open, self-serve red teaming for web apps, repositories, AI agents, and installable packages, runtime guardrails that monitor and enforce what coding agents do, context guardrails that score everything agents consume, and a closed remediation loop from findings to reviewed pull requests. Free for open source. Backed by Y Combinator.

This file is a curated map of https://www.superagent.sh for LLMs and agents. The documentation under /docs is the canonical reference for product behavior. The blog under /blog covers AI security research, benchmarks, and product announcements. The authenticated dashboard and the /api and /app paths are intentionally not listed; everything below is public.

Machine-readable interfaces:

- REST API: https://superagent.sh/api/v1, authenticated with an organization API key. OpenAPI 3.1 spec: https://www.superagent.sh/openapi/v1.yaml
- MCP server: https://www.superagent.sh/mcp — connect Cursor, Claude Code, or Codex CLI to Superagent over the Model Context Protocol.

## Getting started

- [Docs overview](https://www.superagent.sh/docs): What Superagent does — checks on every pull request, red teaming for apps and agents, guardrails for what agents do and consume at runtime.
- [Pricing](https://www.superagent.sh/pricing): Flexible pricing with free private usage, unlimited open-source repository usage, and paid credits shared across billable Superagent products.
- [Quickstart](https://www.superagent.sh/docs/get-started/quickstart): Create an account, connect GitHub, and install the Superagent skill. Three steps, no new workflows.
- [Install GitHub Apps](https://www.superagent.sh/docs/get-started/install-github-apps): Install Superagent Security and Open CLA on chosen repositories to enable PR scans, contributor trust, red-team reports, and CLA checks. Contributor trust and advisory triage start on for public repos only.

## Products

- [PR Scans](https://www.superagent.sh/products/pr-scans): Security checks on every pull request. Superagent Security Scan on the diff; Superagent Supply Chain Scan when a lockfile or manifest changes (npm, PyPI, Go, RubyGems, GitHub Actions). Findings land as GitHub check runs and inline comments. Unlimited on public repos.
- [Secure Dependency Updates](https://www.superagent.sh/products/secure-dependency-updates): Generate dependency update pull requests on a daily, weekly, or monthly schedule, evaluate supported package changes before publication, and withhold blocked proposals.
- [Contributor Trust](https://www.superagent.sh/products/contributor-trust): Scores the GitHub author on every pull request from account history, cross-repo behavior, and contribution patterns. The Contributor trust check can gate merge when you require it.
- [Agreements](https://www.superagent.sh/products/agreements): CLA templates and hashed versions, enforced by the Open CLA GitHub App as a Contributor License Agreement check. Contributors sign from the PR (in-app Markdown or Dropbox Sign).
- [Runtime Guardrails](https://www.superagent.sh/products/runtime-guardrails): Deterministic CEL/YAML rules evaluated on the endpoint. Monitor or block secrets, exfil, and destructive commands. Only findings, decisions, and health leave the machine.
- [Context Guardrails](https://www.superagent.sh/products/context-guardrails): Score web pages, email, messages, files, agent skills, public GitHub MCP repos, and registry packages on identity, behavior, and content before an agent consumes them.
- [Red Team](https://www.superagent.sh/products/red-team): Self-serve adversarial tests against a GitHub repo, a live web app, a deployed agent, a model API, or an installable package. Isolated sandboxes; findings include repro steps and the payload that worked.

## Product documentation

- [PR Scans overview](https://www.superagent.sh/docs/pr-scans): Two scans on every pull request: security on the diff, supply chain on dependency changes, with findings on the exact line and fixes as pull requests.
- [Security scanning](https://www.superagent.sh/docs/pr-scans/security-scanning): Review pull request diffs for suspicious or malicious changes, request scans with `@superagent review`, and allow selected users or bots to trigger reviews and dismiss findings.
- [Supply chain scanning](https://www.superagent.sh/docs/pr-scans/supply-chain-scanning): Score structured package intelligence for direct dependency additions and upgrades, with grouped inline findings and a dedicated GitHub check. The same pipeline scores registry packages on demand through Context Guardrails.
- [Secure Dependency Updates overview](https://www.superagent.sh/docs/secure-dependency-updates): Generate dependency update pull requests on a daily, weekly, or monthly schedule, evaluate supported package changes before publication, and withhold blocked proposals.
- [Runtime Guardrails overview](https://www.superagent.sh/docs/runtime-guardrails): Install the auto-updating standalone CLI, then monitor local and cloud coding agents with endpoint-local rules, durable alerts, and webhooks.
- [Creating agent rules](https://www.superagent.sh/docs/runtime-guardrails/creating-rules): Create endpoint security rules, choose monitor or enforce modes, and review catastrophic-action defaults.
- [Runtime Guardrails rule language](https://www.superagent.sh/docs/runtime-guardrails/rule-language): Write security rules by hand with YAML, CEL expressions, normalized events, parsed shell commands, sequences, and enforcement.
- [Context Guardrails overview](https://www.superagent.sh/docs/context-guardrails): Score web pages, email, messages, public files, agent skills, public GitHub MCP repositories, and registry packages before agents consume them; full repositories are covered by repository red-team reports.
- [Web pages](https://www.superagent.sh/docs/context-guardrails/web-pages): Score a URL before an agent reads it, covering domain identity, page behavior, and rendered content.
- [Email](https://www.superagent.sh/docs/context-guardrails/email): Score raw RFC 822 email with sender identity, MIME structure, attachment metadata, and outbound link analysis.
- [Messages](https://www.superagent.sh/docs/context-guardrails/messages): Score SMS, WhatsApp, and social message text and outbound HTTPS links; media and attachments are outside the endpoint's scope.
- [Files](https://www.superagent.sh/docs/context-guardrails/files): Score a public text or PDF file for source identity, type consistency, encoded instructions, and prompt injection.
- [Agent skills](https://www.superagent.sh/docs/context-guardrails/agent-skills): Statically score a skills.sh or GitHub hosted skill without executing fetched code.
- [MCP repositories](https://www.superagent.sh/docs/context-guardrails/mcp-repositories): Statically score a public GitHub MCP repository without connecting to or executing the server.
- [Packages](https://www.superagent.sh/docs/context-guardrails/packages): Score a registry package with the same supply chain pipeline used on pull requests.
- [Contributor Trust overview](https://www.superagent.sh/docs/contributor-trust): Score contributor identity and malicious intent before code merges. The check is on by default for public connected repositories and off for private ones.
- [Contributor Agreements overview](https://www.superagent.sh/docs/contributor-agreements): CLA templates, versions, and signing workflows, enforced as a check on every pull request.
- [CLA templates](https://www.superagent.sh/docs/contributor-agreements/templates): Create and maintain CLA templates and versions that drive check runs on pull requests.
- [How CLA checks work](https://www.superagent.sh/docs/contributor-agreements/how-cla-checks-work): How Superagent evaluates CLA coverage on pull requests and what contributors see when checks fail.
- [Red Team overview](https://www.superagent.sh/docs/red-team): Self-serve red teaming against what you actually run: your app, repo, agents, and packages.
- [Repository reports](https://www.superagent.sh/docs/red-team/repository-reports): Scan a GitHub repository for security vulnerabilities with an agent that reads the code.
- [Web app reports](https://www.superagent.sh/docs/red-team/web-app-reports): Browser-driven DAST against a live web application.
- [Agent reports](https://www.superagent.sh/docs/red-team/agent-reports): Adversarial tests against an AI agent in production.
- [Package reports](https://www.superagent.sh/docs/red-team/package-reports): Install a package in a sandbox and try to break it.
- [Running reports](https://www.superagent.sh/docs/red-team/running-reports): Follow a red-team run from provisioning to results, and know what to do when one fails.
- [Security Factory overview](https://www.superagent.sh/docs/security-factory): Turn findings into verified decisions and reviewed remediation pull requests with authenticated webhooks, coding agent automations, and the Superagent MCP.
- [Findings overview](https://www.superagent.sh/docs/findings): One triage queue for every security issue, from red-team findings to GitHub advisories.

## API, MCP, and webhooks

- [REST API overview](https://www.superagent.sh/docs/api): Authenticate with the Superagent REST API and manage reports, findings, Contributor Trust scans, context scores, and monitored agents.
- [API: Findings](https://www.superagent.sh/docs/api/findings): List, retrieve, update, delete, and triage security findings through the REST API.
- [API: Reports](https://www.superagent.sh/docs/api/reports): List, retrieve, and create repository, Web app, Agent, and Package security reports through the REST API.
- [API: Contributor Trust](https://www.superagent.sh/docs/api/contributor-trust): Retrieve aggregate contributor scores with verified public source metadata and start asynchronous scans through the REST API.
- [API: Context Guardrails](https://www.superagent.sh/docs/api/context-guardrails): Score web pages, raw email, SMS and WhatsApp messages, public files, agent skills, public GitHub MCP repositories, and registry packages through the REST API.
- [API: Agents](https://www.superagent.sh/docs/api/agents): Manage endpoint clients, groups, security rules, pairing, and alerts through the REST API.
- [OpenAPI specification](https://www.superagent.sh/openapi/v1.yaml): OpenAPI 3.1 spec for the Superagent REST API, including Contributor Trust.
- [MCP server](https://www.superagent.sh/docs/mcp): Install the Superagent skill or manually connect Cursor, Claude Code, or Codex CLI to reports, findings, Contributor Trust, context scans, and Runtime Guardrails.
- [Webhooks](https://www.superagent.sh/docs/webhooks): Send report, finding, Contributor Trust with public source metadata, and agent monitoring events to your own systems, with optional encrypted request headers.
- [Integrations](https://www.superagent.sh/docs/integrations): Wire Context Guardrails into third-party pipelines so untrusted payloads are scored before your application processes them.
- [Resend](https://www.superagent.sh/docs/integrations/resend): Scan inbound Resend email with Context Guardrails before your application processes phishing, credential harvesting, or social engineering.
- [Bird](https://www.superagent.sh/docs/integrations/bird): Use Standard Webhooks for `email.received`, `sms.received`, and `whatsapp.received`, fetching raw email or scanning normalized message text before agent delivery.

## Reference

- [Dashboard](https://www.superagent.sh/docs/reference/dashboard): The Superagent home page: onboarding checklist, org activity, and shortcuts into each product.
- [Repositories](https://www.superagent.sh/docs/reference/repositories): Connected GitHub repositories and the per-repo settings that control scans, trust checks, and CLA. Contributor trust and advisory triage default on for public repos and off for private repos.
- [Settings](https://www.superagent.sh/docs/reference/settings): Organization profile, members, API keys, and webhooks in the Superagent dashboard.
- [Glossary](https://www.superagent.sh/docs/reference/glossary): Definitions of Superagent terms, including message scans, email scans, Context Guardrails, static MCP repository scans, and package scans.
- [Troubleshooting](https://www.superagent.sh/docs/reference/troubleshooting): Common issues with GitHub Apps, pull request scans, reports, findings, and CLA checks.

## Blog

- [Building a Security Factory with Superagent and Cursor](https://www.superagent.sh/blog/building-a-security-factory): Superagent acts as the attacker and Cursor as the executor, turning verified findings into reviewed pull requests in minutes.
- [When a Trusted Contributor Gets Compromised](https://www.superagent.sh/blog/when-a-trusted-contributor-gets-compromised): We analyzed 8,897 evidence-backed GitHub posture findings to measure how repository controls limit a compromised contributor.
- [When Terminal Output Owns Your Clipboard: OSC 52 in Warp](https://www.superagent.sh/blog/when-terminal-output-owns-your-clipboard-osc-52-in-warp): Affected Warp builds honored OSC 52 clipboard escape sequences from terminal output, allowing silent clipboard reads and writes with no default-deny gate.
- [A bad patch is worse than no patch](https://www.superagent.sh/blog/a-bad-patch-is-worse-than-no-patch): AI makes vulnerability discovery cheap, but closing vulnerabilities still requires validation, safe fixes, and human-reviewed merges.
- [Backburning Open Source: Partnering with dotenvx](https://www.superagent.sh/blog/backburning-open-source-partnering-with-dotenvx): How the dotenvx partnership finds vulnerabilities before attackers do and closes the silent window with hardened packages.
- [Frontier models miss 57% of threats in agent context](https://www.superagent.sh/blog/frontier-models-miss-57-percent-of-threats): 485 real artifacts through Claude 4.6 Opus with a security-focused system prompt missed 57% of the threats brin had already identified.
- [The Cline Incidents and the Broken Security Model](https://www.superagent.sh/blog/cline-incident-broken-security-model): Two Cline security incidents expose the same problem: AI agents treat untrusted content as instructions.
- [Launching brin.sh — realtime threat detection for agents](https://www.superagent.sh/blog/launching-brin-sh): Brin scores everything your agent is about to consume before it does. Free to use, no auth, no SDK, no signup.
- [What Can Go Wrong with AI Agents](https://www.superagent.sh/blog/what-can-go-wrong-with-ai-agents): Data leaks, compliance violations, unauthorized actions — how AI agents fail in ways traditional software doesn't.
- [We Bypassed Grok Imagine's NSFW Filters With Artistic Framing](https://www.superagent.sh/blog/grok-image-jailbreak): Text-to-image safety is broken; explicit content of a real person via basic compositional tricks.
- [AI Code Sandbox Benchmark 2026](https://www.superagent.sh/blog/ai-code-sandbox-benchmark-2026): Modal vs E2B vs Daytona vs Cloudflare vs Vercel vs Beam vs Blaxel, evaluated on developer experience and pricing.
- [The Threat Model for Coding Agents is Backwards](https://www.superagent.sh/blog/threat-model-for-coding-agents-is-backwards): With coding agents, the user is the victim, not the attacker.
- [AI Guardrails Are Useless](https://www.superagent.sh/blog/ai-guardrails-are-useless-in-their-current-form): Most guardrails are generic, static, and disconnected from what matters for your specific agent.
- [Introducing Superagent Guard](https://www.superagent.sh/blog/superagent-guard-frontier-guardrails-for-ai-agents): Purpose-trained models that detect prompt injections, identify jailbreak attempts, and enforce guardrails at runtime.
- [SOC-2 is table stakes now](https://www.superagent.sh/blog/soc-2-is-table-stakes): What actually matters for AI products beyond the certification badge.
- [Red Teaming AI Agents: What We Learned From 50 Assessments](https://www.superagent.sh/blog/red-teaming-ai-agents-learnings): Critical patterns from red teaming 50 AI agents across companies, industries, and setups.
- [Open Source AI Models: A Safety Score Reality Check](https://www.superagent.sh/blog/open-source-ai-model-a-safety-reality-check): Safety scores for open-weight models you can deploy without vendor lock-in.
- [Your System Prompt Is the First Thing Attackers Probe](https://www.superagent.sh/blog/your-system-prompt-is-the-first-thing-attackers-probe): Attacks on AI agents start by probing the instructions that define behavior, tools, and boundaries.
- [Your RAG Pipeline Is One Prompt Away From a Jailbreak](https://www.superagent.sh/blog/your-rag-pipeline-is-one-prompt-away-from-a-jailbreak): Malicious files, knowledge base poisoning, and indirect prompt injection turn RAG into an attack surface — and how to defend against it.
- [Practical guide to building safe & secure AI agents](https://www.superagent.sh/blog/practical-guide-to-ai-agent-safety): System prompts aren't enough; runtime protection against prompt injection, poisoned tool results, and the lethal trifecta.
- [AI Is Getting Better at Everything—Including Being Exploited](https://www.superagent.sh/blog/ai-is-getting-better-at-everything): The GPT-5.1 safety score drop shows capability and attack surface scale faster than safety.
- [Are AI Models Getting Safer? GPT vs Claude Over Time](https://www.superagent.sh/blog/gpt-vs-claude-ai-safety-benchmark): 18 months of Lamb-Bench safety scores for GPT and Claude models.
- [Introducing Lamb-Bench](https://www.superagent.sh/blog/introducing-lamb-bench): An adversarial testing framework that gives buyers and sellers a common AI safety measurement standard.
- [VibeSec: The Current State of AI-Agent Security and Compliance](https://www.superagent.sh/blog/vibesec-the-current-state-of-ai-agent-security-and-compliance): Notes from dozens of conversations with developers building AI agents and LLM-powered products.
- [The March of Nines](https://www.superagent.sh/blog/the-march-of-nines): The hidden reliability engineering between a working demo and a production AI system.
- [The case for small language models](https://www.superagent.sh/blog/the-case-for-small-language-models): Single-job agents deserve purpose-built models that run locally and can be retrained as your data evolves.
- [Why Your AI Agent Needs More Than Content Safety](https://www.superagent.sh/blog/why-your-ai-agent-needs-more-than-content-safety): Content filtering isn't enough when your AI takes actions.
- [Shipped: Runtime Redaction and Command-Line Security](https://www.superagent.sh/blog/runtime-redaction-and-cli-ship-week): Runtime redaction, a powerful CLI, URL whitelisting, and security directly in the developer workflow.
- [Three years later: AI can (now) defend AI](https://www.superagent.sh/blog/three-years-later-ai-can-now-defend-ai): What changed since Simon Willison's 2022 argument that "adding more AI" was the wrong fix for prompt injection.
- [Introducing Superagent — Defend Your AI Agents in Runtime](https://www.superagent.sh/blog/introducing-superagent): The runtime defense platform against prompt injections, malicious tool calls, and data leaks.
- [Alignment Faking: The New AI Security Threat](https://www.superagent.sh/blog/alignment-faking-the-new-ai-security-threat): Strategic deception by LLMs complicates traditional safety measures and necessitates technical countermeasures.
- [Announcing Support for Cursor Agent and OpenCode](https://www.superagent.sh/blog/cursor-agent-opencode-support): VibeKit's universal agent support provides a consistent security and observability layer across preferred agents.
- [Introducing VibeKit CLI](https://www.superagent.sh/blog/introducing-vibekit-cli): The safety layer for running AI coding agents with direct access to your environment.
- [Introducing Dagger Local Sandboxes](https://www.superagent.sh/blog/dagger-local-sandboxes): VibeKit support for Dagger-powered local AI code execution with container isolation and zero cloud dependencies.
- [Grok CLI Gets MCP Support](https://www.superagent.sh/blog/grok-cli-mcp-support): MCP support turns Grok CLI into a connected terminal agent that can use 1000+ development tools.
- [Introducing Cloudflare Sandboxes Support](https://www.superagent.sh/blog/cloudflare-sandboxes-support): VibeKit support for Cloudflare Sandboxes — AI code execution at the edge across 300+ global locations.
- [Introducing @vibe-kit/auth](https://www.superagent.sh/blog/introducing-vibekit-auth): Use Claude, Gemini, or Grok Max subscriptions across any application through secure OAuth flows.
- [Vibex: Rebuilding OpenAI Codex with VibeKit](https://www.superagent.sh/blog/vibex-rebuilding-openai-codex-with-vibekit): An open-source coding agent that runs tasks in secure E2B containers and produces working GitHub pull requests.
- [On vibe coding](https://www.superagent.sh/blog/on-vibe-coding): A new way of building software that skips the traditional engineering process.
- [Prompting is not a skill, prompting is engineering](https://www.superagent.sh/blog/prompting-is-not-a-skill-prompting-is-engineering): Prompts should be treated as engineered systems, not isolated tasks.
- [The death of AI agents](https://www.superagent.sh/blog/the-death-of-ai-agents): Why today's complex, over-engineered agent systems are about to be replaced.
- [ReAG: Reasoning-Augmented Generation](https://www.superagent.sh/blog/reag-reasoning-augmented-generation): Query documents with full context instead of retrieve-then-read chunking.
- [Agents that write their own tools](https://www.superagent.sh/blog/agents-that-write-their-own-tools): Really useful agents need specialized tools — and can write their own.
- [The 1700s paradox](https://www.superagent.sh/blog/the-1700s-paradox): Klarna CEO Sebastian Siemiatkowski's analogy about AI capability, examined.
- [The future of LLM costs](https://www.superagent.sh/blog/the-future-of-llm-costs): Competing visions of where Large Language Model pricing goes.
- [$2K Per Task](https://www.superagent.sh/blog/openai-s-o3-at-2k-per-task): OpenAI's o3 model marks PhD-level performance at a pivotal price point.
- [AI Agents vs RPA](https://www.superagent.sh/blog/ai-agents-vs-rpa): The widespread adoption of hardcoded workflows sold as AI agents.

## Customer stories

- [Customer stories](https://www.superagent.sh/customer-stories): How teams use Superagent in production.
- [How Capchase ships AI features without losing sleep](https://www.superagent.sh/customer-stories/capchase): Capchase runs every file, prompt, and web fetch through Superagent before it reaches an agent — enforced with a lint rule, not a README.
- [How dotenvx hardens open source secrets management](https://www.superagent.sh/customer-stories/dotenvx): Superagent probes dotenvx continuously and turns findings into upstream patches the dotenvx team can review, merge, and ship.

## Company

- [About Superagent](https://www.superagent.sh/about): Mission and team — an AI security team that finds, patches, and discloses vulnerabilities in code and agents. Backed by Y Combinator.
- [Changelog](https://www.superagent.sh/changelog): Product updates, including Security Factory, a scope option for Secure Dependency Updates, scheduled secure dependency updates, review access for GitHub users and automation bots, SMS and WhatsApp scoring in Context Guardrails, README security badges, Context Guardrails package scans, and package red teaming.
- [Blog index](https://www.superagent.sh/blog): All posts on AI security research, benchmarks, and product announcements.

## Optional

- [Legal](https://www.superagent.sh/legal): Hub for all Superagent legal documents.
- [Privacy Policy](https://www.superagent.sh/legal/privacy-policy): How Superagent collects, uses, discloses, and protects personal information.
- [Cookie Notice](https://www.superagent.sh/legal/cookie-notice): Cookies and similar technologies used across the Superagent website and application.
- [Website Terms of Use](https://www.superagent.sh/legal/terms-of-use): Terms governing the public Superagent website.
- [Services Agreement](https://www.superagent.sh/legal/services-agreement): Terms for Superagent products, plans, APIs, integrations, MCP access, and webhooks.
- [Global Data Processing Addendum](https://www.superagent.sh/legal/dpa-global): Global data protection terms for Customer Data processed by Superagent.
- [Subprocessor List](https://www.superagent.sh/legal/subprocessors): Infrastructure, email, AI, security, billing, and authentication providers that may process service-related data.