changelog

Superagent now scans dependency changes in pull requests for supply chain risks before they reach your default branch.

A dedicated pull request check

The new Superagent Supply Chain Scan runs alongside the existing security scan whenever a supported manifest, lockfile, or GitHub Actions workflow changes. It compares the pull request with its base commit and analyzes only added or upgraded dependency versions.

Findings where you review code

Actionable risks appear as inline review comments on the changed dependency line. Related signals are grouped into one issue per dependency, keeping the review focused while preserving the full rule-level evidence in the check details.

Merge protection that clears when fixed

The check fails when Superagent finds an actionable supply chain issue. Remove or replace the risky dependency and push a new commit to rerun the scan; once no actionable dependency changes remain, the check passes automatically.

Repository owners can deactivate supply chain scans at any time from the repository detail page.

Superagent now exposes its REST API as a remote Model Context Protocol server, so an AI coding agent can read findings, inspect reports, and start new security work without you writing any integration code.

What you can do

Ask your agent to work the security queue in plain language:

• Start red-team reports against a connected repository or a public Web app, then check on progress.
• Manage findings — list and retrieve them, update triage state, trigger automated triage, or delete them.
• Review reports — list and retrieve repository and Web app reports and see whether the latest run finished.

Every /api/v1 operation is available as a tool, and responses include both readable text and structured JSON.

One command to connect

Point Cursor, Claude Code, or Codex CLI at https://www.superagent.sh/mcp and authenticate with the same organization API keys you already use for the REST API. No OAuth flow to set up — the key is the credential.

claude mcp add --transport http --scope user superagent \
  https://www.superagent.sh/mcp \
  -H "Authorization: Bearer sk_live_..."

Read the MCP documentation to connect your client.

Superagent can now connect directly to your internal agents, ticketing systems, and security workflows through organization webhooks and a versioned REST API.

Organization API keys

Create and revoke API keys from Settings, then use Bearer authentication to access resources scoped to your organization.

Reports and findings API

The new /api/v1 endpoints can start repository and Web app security reports, list and retrieve findings, update finding status, and trigger automated triage. Finding responses include report, triage, evidence, and remediation context so external tools can act without scraping the dashboard.

Signed lifecycle webhooks

Subscribe endpoints to report and finding lifecycle events. report.started confirms that a repository or Web app report was accepted, while report.finished closes the loop when execution enters review or fails. Finding events cover new findings, completed triage, and accepted risks.

End-to-end automation

Use signed webhook payloads to orchestrate work around the API without polling. Deliveries include safe report status or structured remediation context, retry transient failures automatically, and can be configured, tested, rotated, or disabled from Settings.

Read the API documentation and webhook guide to get started.

Superagent now gives findings a more focused workspace for reviewing, prioritizing, and resolving security work.

Kanban triage

Findings are organized into a board so teams can move issues from new to review to resolved without losing context.

Severity and repository grouping

The board can group findings by severity, repository, or both, making it easier to see the riskiest work and route it to the right owners.

Qualifier search

Search now supports free text plus qualifiers like status, risk, source, resolution, and repo, with active findings shown by default.

Contributor Credit Score v2 makes deterministic GitHub evidence the source of the published trust score.

Explainable account signals

Profiles now show positive evidence, concerns, contextual observations, and unavailable sources across account history, contribution patterns, repository originality, public identity, commit verification, and pull-request outcomes.

Evidence-aware confidence

Missing GitHub data no longer behaves like a zero-value signal. The score records evidence coverage and becomes inconclusive when core account evidence cannot be collected.

One-way history review

Sandboxed patch review remains a safety layer. Concrete suspicious historical patches can lower a contributor's score, while clean or incomplete history review cannot inflate the deterministic result.

Superagent now gives teams a dedicated notifications feed for important security and contributor activity.

Activity inbox

The new feed groups notifications by day and starts with unread updates so teams can quickly catch up.

Finding and contributor context

Notifications include context for findings, repositories, contributors, and pull requests so each update is easier to act on.

Email preferences

Users can choose which notification types should also be delivered by email.

Sidebar visibility

Unread counts now appear in the app sidebar, keeping important updates visible while teams work.

Superagent now reviews more contributor history before assigning trust, with deeper PR evidence and faster cached checks.

Broader history evidence

The scan ranks recent authored pull requests by risk and hydrates the most useful examples with patch and review context.

Parallel sandbox investigators

Larger contributor histories can be split across isolated investigators, then merged into one contributor verdict.

Patch-level safety guardrails

Safe results now require concrete patch-level evidence, with weak or metadata-only reviews downgraded automatically.

Faster checks for active contributors

Contributor trust scans are cached and warmed after PR activity so follow-up checks are faster.

Superagent now gives security and platform teams a deeper way to understand who is contributing code. Deep Contributor Credit Score analyzes contributor history, repository context, and patch-level evidence to produce an explainable trust signal before a pull request reaches production.

Hydrated contributor history

The score reviews hydrated historical pull requests for the contributor, looking across performance optimization work, cross-repository patterns, internal product features, safety infrastructure, and other high-signal code paths. This gives reviewers more context than the current diff alone can provide.

Explainable trust signals

Each score includes the evidence behind the result: CLA status, last activity, organization alignment, issue linkage, omitted evidence, and confidence levels for patch-level review. Teams can see why a contributor is trusted, suspicious, or needs additional review without reverse-engineering a black-box verdict.

Patch-level safety review

Contributor scoring is combined with patch-level inspection for risky behavior such as credential access, hidden network calls, dependency abuse, permission broadening, or suspicious code paths. The result is a focused review workflow that helps teams distinguish trusted collaboration from changes that need deeper investigation.

Superagent now meets your team where work already happens: on GitHub. This release connects repository configuration, automated adversarial testing, CLA management, and advisory triage into a single workflow, so you can ship faster without trading off security review.

Configure repositories

Choose which repositories Superagent protects, set scan and policy preferences per repo, and keep ownership clear across your organization. Onboarding is straightforward: connect GitHub, pick the repos that matter, and your team gets a consistent baseline before code or agents reach production.

Adversarial tests on GitHub events

Trigger adversarial tests automatically from GitHub events, such as pull requests and pushes, so risky changes are challenged before they merge. Tests run in the background against your configured policies, surfacing failures and findings where developers already review code.

Create and manage CLAs

Create and manage Contributor License Agreements without leaving Superagent. Define agreement templates, track contributor status, and keep open-source contribution workflows compliant as your projects and policies evolve.

Triage GitHub advisories automatically

Incoming GitHub security advisories are triaged automatically: Superagent assesses severity and relevance, groups related signals, and helps your team focus on what needs action now versus what can wait. Less manual sorting, faster response when a dependency or repo is at risk.