> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt. Run adversarial security work across applications, repositories, agents, infrastructure, and package artifacts. # Red Team Scanners tell you about known CVEs. Red Team shows how an attacker could break what you built. Superagent runs adversarial campaigns against your real surface: black-box against public applications and installable packages, gray-box with repository context. Every finding ships with repro steps and the payload that worked, ranked by severity against your architecture rather than a generic checklist. All reports live under [Red team](https://www.superagent.sh/app/reports) in the dashboard, in one list across every target type. ## Pick a target | Target | What it tests | Access needed | | --- | --- | --- | | [Repository](https://www.superagent.sh/docs/security-workers/red-team/repositories) | A GitHub codebase, scanned for vulnerabilities, unsafe patterns, and config issues | Superagent Security installed on the repo | | [Application](https://www.superagent.sh/docs/security-workers/red-team/applications) | A live application, probed by browser-driven DAST | A public HTTP or HTTPS URL | | [Agent](https://www.superagent.sh/docs/security-workers/red-team/agents) | A deployed AI agent tested for jailbreaks, policy gaps, and unsafe behavior | A description of the agent under test | | [Package](https://www.superagent.sh/docs/security-workers/red-team/packages) | Installable software or a CLI, installed in a sandbox and adversarially tested | Installation instructions | ## Start a Red Team run Start from **Red team → New report** (`/app/reports/new`), pick a target type, and fill in the details. The Red Team run proceeds asynchronously in an isolated sandbox. Its red-team report stores status, evidence, findings, and the final result. You can also start repository, application, Agent, and Package runs from the [Reports API](https://www.superagent.sh/docs/api/reports) or the [MCP server](https://www.superagent.sh/docs/mcp). Both consume organization credits. ## Follow the run Red Team runs execute asynchronously in an isolated sandbox. Starting one returns immediately, and its red-team report detail page shows progress and results. Three status fields tell you where a run stands: | Field | Values | | --- | --- | | Report status | In progress, In review, Completed, Done (legacy), Failed | | Sandbox status | Pending, Provisioning, Ready, Failed | | Agent status | Pending, Installing, Running, Completed, Needs Review, Failed | A healthy run moves from provisioning to running to **In review**, where results wait for your decision. **Completed** means the report review is finished; it does not change scan execution or individual finding resolutions. A successful scan with no findings is automatically Completed. Once every finding is resolved (Fixed, Accepted risk, False positive, or Won’t fix), the report also completes automatically. New or reopened unresolved findings move it back to In review. Any organization member can manually set a successfully finished report to Completed, even with unresolved findings, or return it to In review. Failed and running scans cannot be manually completed. Existing reports are not automatically updated until their findings change. Legacy Agent test results are not triageable and do not affect automatic completion; only Agent advisories count. Failures in provisioning or execution land on **Failed** with safe error context. Repository runs can also trigger automatically on a GitHub release, a tag, or a schedule instead of manual creation. ### Reviewing results You can also change review status through `PATCH /api/v1/reports/{report_id}` or the MCP tool `update_report_review_status`. Both accept `completed` or `in_review` and apply the same eligibility rules as the dashboard. See the [Reports API](https://www.superagent.sh/docs/api/reports#update-report-review-status) and [MCP reference](https://www.superagent.sh/docs/mcp#report-review-status). | Signal | Where to look | | --- | --- | | Overall status | Report detail header and the **Red team** list | | Agent activity | The live event feed on the detail page | | Findings | The report's findings section and the org-wide [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue | | Evidence | Recordings and screenshots on application reports | Application reports also show the browser session live while the agent works, and a recording afterwards. See [Applications](https://www.superagent.sh/docs/security-workers/red-team/applications). ### Rerun or automate Application runs can be started again from the detail page. To wire the lifecycle into your own systems, subscribe to `report.started` and `report.finished` [webhooks](https://www.superagent.sh/docs/webhooks). `report.finished` fires once per report, with the outcome and a link back to the dashboard. ### When a report fails - Confirm the GitHub App still has access to the repository. - Verify the repository exists and is selected in the app installation. - For application reports, check that the target URL is public and your WAF allows the scanner. - For agent reports, check that the description and type match the target you intend to test. - See [Troubleshooting](https://www.superagent.sh/docs/reference/troubleshooting). ## From report to fix Findings from repository and application reports land in the [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue with repro context. Automated triage verifies them, and confirmed findings can become fix PRs without leaving the queue. ## Next steps - [Run repository Red Team](https://www.superagent.sh/docs/security-workers/red-team/repositories) - [Run application Red Team](https://www.superagent.sh/docs/security-workers/red-team/applications) - [Run Agent Red Team](https://www.superagent.sh/docs/security-workers/red-team/agents) --- Source: https://www.superagent.sh/docs/security-workers/red-team Index: https://www.superagent.sh/llms.txt