What it does
Security Agent turns a pile of scanner output into a review a person can actually act on. You supply the raw hits — Semgrep for OWASP and CWE rules, Trivy and Snyk for dependency CVEs, plus your own company Custom Instruction rules like "no plaintext secrets in version control" — and it classifies every one deterministically by CVSS v3.1 base score: critical at 7.0 and above, warning from 4.0 to 6.9. The step that saves the most time is the false-positive triage. Scanner output buries real issues in noise, so the agent removes false positives from the actionable list automatically while still counting them in the report, which keeps the number auditable instead of making it disappear. `triage_false_positives` shows you exactly which ones were excluded and why they no longer appear. Every real finding carries the CWE and OWASP identifier, the file and line, the scanner it came from, the concrete exploit scenario and the suggested fix. None of it is invented — each field comes from the hit you supplied, and the language model only narrates the summary in a security-champion voice. Each step is callable on its own. `compute_max_cvss` answers "how bad is the worst thing in here" without running anything else. `count_custom_instruction_hits` separates violations of your own internal rules from generic OWASP findings, which is usually a different conversation with a different owner. `run_full` is the orchestrated path when you want the whole report. Alongside the findings it proposes a patch PR and regression tests that guard the patched vulnerabilities. The pull request is flagged as requiring a second human approval, and the agent has no merge path at all — that is the repo's stated risk policy, not a setting you have to remember to check. No connectors and no credentials: it runs on the scan batch you provide. Built for developers and security champions.
Example prompts
- Here is our Semgrep and Snyk output — which findings are real?
- What is the worst CVSS score in this scan batch?
- Which of these hits came from our own security rules rather than OWASP?
