Superagent
Superagent · Coding
Superagent runs autonomous security workers that scan pull requests, update dependencies, red team your apps, and guard agent runtime, then report findings to your coding agents.
About Superagent
What Is Superagent
Superagent is a security platform for teams that ship software with AI agents in the loop. Connect a repository, a running app, or an agent endpoint, and its security workers get to work: checking risky code before merge, verifying who wrote it, hunting exploitable paths, and watching what an agent does at runtime. Findings land in the coding tools you already use instead of one more inbox. Your agents send structured reports back through MCP, and Superagent keeps that evidence for the next round.
The pitch is speed. A vulnerability caught before merge costs a review comment. The same flaw found after release costs an incident, a patch window, and a security review. Superagent tries to shrink that gap by running security work continuously instead of in quarterly bursts.
The limits matter too. Credits drive everything, and a full red team report costs 500 of them, so small teams need a plan for what they run and how often. The product works on your repos and endpoints, which means you hand it real access to code and infrastructure. None of this replaces a human reviewer for design decisions or business logic flaws.
Getting Started
- Create an organization account and copy the API key for your security factory.
- Connect the systems you want protected, such as a GitHub repository, a deployed app, or an agent endpoint.
- Turn on the capabilities you need, starting with PR scans if you want one quick win.
- Install the Superagent MCP server so your coding agents can pull findings and return structured reports.
- Set your agent destinations and webhooks, then read the first batch of findings in the dashboard.
Product Information
A quick look at Superagent's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Engineering teams shipping AI features
- Open source maintainers
- Solo developers and small studios
Tasks
- Reviewing pull requests for supply chain and workflow risk
- Keeping dependencies current
- Testing how an app handles attack traffic
- Filtering what an agent reads
Scenarios
- A startup with no security hire
- An agent product already in production
- Checks before a tight release date
Key features
PR Security
Superagent inspects code, contributor history, workflow files, and supply chain risk before a merge. Each scan costs 1 credit, and you can target base branches and cap how often repository scans run. The output is a decision, not a wall of alerts: merge, hold, or escalate.
Red Team
Red team runs attack your shipped systems on purpose, with evidence and reproduction steps attached to each finding. This is AI red team work rather than a static checklist: runs chain weaknesses the way an attacker would. A full report costs 500 credits, so teams usually schedule one before a major release or after a big architecture change. Reports close on their own once every finding is resolved, or stay open for manual review in the dashboard, API, or MCP.
Secure Dependency Updates
Superagent generates dependency changes on your schedule and evaluates the complete proposal before a pull request opens. Version bumps arrive with a verdict attached instead of a wall of green checkmarks. Live private runs cost 5 credits, and public repos plus dry runs are free.
Context and Runtime Guardrails
Context guardrails score what an agent consumes before it trusts that content, at 1 credit per item checked. Runtime guardrails sit where the agent actually runs and can watch or block risky actions. Together they cover the two moments where AI agent security usually breaks: bad input going in, bad actions coming out.
Security Factory
The security factory is the loop that ties the pieces together. Findings become verified decisions, and those decisions turn into reviewed remediation pull requests. Agents return structured reports through MCP, and Superagent reuses the evidence in later work, so the second scan on a repository starts with context the first one never had.
API, MCP, and the Safety SDK
Every plan includes API and MCP access with unlimited seats. The REST API ships with an OpenAPI 3.1 spec, and the MCP server at superagent.sh/mcp connects your agents to the security workers. Developers who write their own checks can use the open source safety-agent SDK, which handles guard, redact, and scan calls in TypeScript and Python.
Pros and cons
Pros
- Security work runs on every pull request instead of waiting for a scheduled audit.
- Findings reach coding agents through MCP, so fixes start where developers already work.
- Public repositories are free without a credit cap, which is rare for a paid security product.
- API and MCP access plus unlimited seats come with every plan, including the free one.
- The open source SDK lets a team add prompt injection blocking and PII redaction to its own app.
Cons
- Credits go fast at the top end: a single red team report costs 500 credits, five times a free month of private usage.
- Real coverage needs repository and runtime access, which is a hard sell for teams with strict infrastructure rules.
- The product assumes an agent based workflow, so teams without coding agents get less from the report loop.
- Paid pricing starts at $499 a month, with no small plan between free and Starter.
Frequently asked questions
Superagent runs security workers against your code, dependencies, apps, and AI agents. Each worker handles one job, such as scanning a pull request or completing a red team report, then sends findings to the coding agents and workflows your team already uses.
Related content
Explore related tools, skills, and articles for Superagent.
Superagent Alternatives
Base Code
Base44 (Wix) · Coding · ProductivityBase Code is a shared cloud development environment from Base44. Teammates describe changes to an existing GitHub codebase in chat, preview them live and send them back as pull requests.
Google EmbeddingGemma 2
Google DeepMind · Writing · Image · CodingGoogle EmbeddingGemma 2 is a 740M-parameter open model that turns text, code, images, audio, and video frames into vectors in one 768-dimension space, running on phones and laptops.
GitGlow
GitGlow · Coding · ProductivityGitGlow is a local-first desktop Git client that lets independent developers review their own code and their AI agents' changes in one place before shipping.