Superagent

The pitch that separates Superagent from a conventional scanner is that each worker owns one job end to end and returns code rather than a finding row. PR Security reviews code, workflow, dependency, and contributor risk before merge and can block risky changes and untrusted contributors. Secure Dependency Updates — the newest worker, shipped September 11, 2026 — finds available dependency versions, runs pinned Dependabot tooling in an isolated sandbox, evaluates supported package changes, and opens manifest and lockfile pull requests on a daily, weekly, or monthly schedule; updates that block on supply chain policy are withheld before a PR ever opens. A follow-up on September 13 added scope selection: vulnerability remediation (which requires Dependabot alerts: read-only on the Superagent Security GitHub App), direct version updates, or both, with vulnerability remediation as the default. Red Team maps the exploit paths an attacker would actually chain; the dotenvx customer story describes it chaining vulnerabilities the way a real kill chain builds, and patching them before a third-party scanner flagged the same issue. The guardrail story is the second half. Runtime Guardrails constrain what a coding agent is allowed to do locally, while Context Guardrails score what it consumes across five origins: web pages (domain identity, redirect chains, hidden DOM, rendered text), email (sender authentication, phishing and injection patterns, attachments, outbound links), files (public text and PDFs, with file bytes never stored), agent skills (GitHub publisher identity, requested capabilities, install hooks — skill files are treated as untrusted data and never executed), and public GitHub MCP repositories (static review of tool descriptions, schemas, instructions, hooks, and secrets; Superagent never connects to a live MCP endpoint). Every scan returns a 0–100 score, a safe/caution/suspicious/dangerous verdict, and a confidence level, and cached results are reused across organizations. The September 7, 2026 changelog extended this to inbound SMS and WhatsApp text — checking message text and outbound HTTPS links for phishing, prompt injection, and social engineering before an agent follows a link. Attachments are explicitly not scanned, and that is the sharpest edge of the messaging coverage. Package scans landed August 17 for npm, PyPI, Go, RubyGems, and GitHub Actions, using the same supply chain pipeline as PR checks, with scan failures failing closed rather than returning a safe result. The operational details are where teams will actually feel this. PR review access can be delegated to exact GitHub logins, including automation bots such as github-actions[bot] (September 10, 2026), so a bot can comment "@superagent review" even when automatic scans are off — though Superagent's own bots are blocked to prevent review loops, and the product is designed so people approve consequential changes. Public repos can embed a shield and security card showing