Superagent review

Superagent is a security platform that runs checks across code, dependencies, applications, agents, and infrastructure. It sits alongside development and operations workflows: it performs scans or investigations, then sends findings into the workflows teams already use. The vendor presents it as an always-on security service, with API and MCP access available across its plans.

Its products divide the work into PR scanning, red teaming, dependency validation, context guardrails, runtime guardrails, and Security-One-27B event scoring. That puts it across several points in a stack: pre-merge review, package updates, agent input and actions, and security-event routing. The homepage names GitHub, Cursor, Claude Code, and Codex as integrations. Superagent is not presented as a code library or a standalone CLI in the vendor’s homepage material; buyers should confirm the service’s deployment model and integration requirements with the vendor before designing around it.

Plans include API and MCP access, and the homepage lists GitHub, Cursor, Claude Code, and Codex as integrations. Its use-case examples describe sending repository findings to Cursor, running application checks through Devin automation, and routing Supabase log classifications for review. These examples show the intended pattern: Superagent performs security work, then connects the result to an existing tool or workflow.

The homepage does not name an API style, SDKs, programming languages, CLI, or webhook protocol. Confirm SDK support, authentication, request and response formats, and integration setup in the vendor’s docs before choosing an implementation path. The homepage links to product documentation for each feature, but does not establish the depth of those docs or whether integrations are configured through code, a dashboard, or both. MCP access may fit tool-using agent workflows; verify the supported operations and permissions before exposing it to production agents.

The Open source plan costs $0/month and lists unlimited usage on public repositories, every Superagent product, API and MCP access, and unlimited seats. For private repositories, the free plan includes 100 credits/month. Starter costs $499/month for 500 credits; Growth is $1,499/month for 2,000 credits; Scale starts at $3,999/month for 6,000 credits. Each paid tier includes every product, API and MCP access, and unlimited seats.

Credit use depends on the job: PR scanning costs 1 credit per scan, private dependency investigations cost 5 credits, red teaming costs 500 credits per report, and context checks cost 1 credit per item. Public dependency investigations are free. Security-One-27B is separately priced at $0.05 per 1 million input tokens. Annual plans are billed upfront and include 20% more credits, but annual prices are not published. The pricing page does not list overage rates, so ask what happens when a private project exhausts its monthly credits before relying on uninterrupted scans.

The Open source plan is a pricing option for unlimited public-repository usage; that plan name does not establish that Superagent’s product code is open source. The vendor does not publish a software license or source-code availability in the homepage material. It also does not publish self-hosting instructions or state that customers can run the service on their own infrastructure. Treat Superagent as a hosted service for planning purposes until the vendor confirms deployment options.

The homepage says integrations and workflows stay in place, and plans include API and MCP access. That may reduce workflow replacement, but it does not establish data portability. The vendor does not publish export formats, retention policies, or migration procedures here. Before committing, ask how to export findings, configurations, and history, and whether API access covers the data needed to move to another security system.

Credit limits are the clearest published production constraint: private plans include 100, 500, 2,000, or 6,000 monthly credits, depending on tier. Red teaming consumes 500 credits per report, so repeated reports can use a plan’s allocation quickly. The vendor does not publish overage pricing in the pricing details; confirm whether jobs stop, queue, or incur extra charges when credits run out.

Before putting Superagent in a critical path, ask for API rate limits, availability targets, support response times, and behavior during service or integration failures. The vendor should also clarify data retention, handling of source code and agent inputs, access controls, and any compliance certifications relevant to your environment. Runtime guardrails use host-evaluated rules to block supported risky actions, but confirm which hosts and actions are supported and how rule changes are managed. The homepage does not publish scaling or reliability limits, so validate them against your expected workload.