Guard · Agent Code Security

Agent Code Security

Three scans over what your coding agents actually write, rolled up across every machine on the team. A scan of the agent's own diff joined to the session that produced it, a check on whether the dependencies the agent added exist at all, and a gate that catches a secret at the moment an agent writes it. Each scan runs on the developer's machine; the hosted page shows who flagged what, and nothing else.

Where to find it

  • Hosted: /team/agent-code-security
  • Sidebar: Guard, then Agent Code Security
  • Where the evidence lives: the desktop app, under Guard then Security. Agent code scan (/agent-code-scan.html), Vulnerabilities (/vulnerabilities.html), and Guardrails (/security-guardrails.html). Every row on the hosted page deep-links back to one of them.

What it does for you

Scans the agent's diff, and says which session wrote the line.RepoOps does not rebuild a static analyzer. It shells out to Semgrep over the diff the agent produced (working tree against origin/main) and adds the part only RepoOps holds: the session that produced that diff, and what the session cost. When Semgrep is genuinely absent, a small built-in pass over the added lines runs instead, and the page says which one ran.
Catches a package the agent invented.A coding agent sometimes names a package that does not exist, and attackers register the names models invent. An audit of the dependency tree cannot see this, because it only checks packages that are real. This check looks at the dependencies the agent added and asks whether each one exists, and whether it is a days-old package with no downloads squatting a plausible name.
Blocks a secret before it reaches git.The write-time gate wraps the same pattern table the redactor uses, so there is no second secret-pattern list to drift. When a pattern matches content an agent is about to write, the gate records a blocked event and hands back the redacted view.
The hosted page carries metadata, never evidence.A row holds the source, the rule or package name, the severity, a count, and for the secret gate a class plus a fingerprint. It never holds a source line, a secret value, or a preview, because none is stored. The team read is a team-keyed forty-five second memo, and the authorization decision that gates it is never cached.

Built vs. planned

All three scans and the hosted rollup ship today, backed by lib/agent-diff-scan.mjs, lib/dependency-provenance.mjs, and lib/secret-gate.mjs, read on the hosted side through website/lib/agent-code-findings-read.ts. The diff scan prefers Semgrep and resolves it from the places pip and pipx install it before falling back, so a machine without it on the bare PATH still gets a real scan. A machine that has published no findings shows an empty table rather than a green pass.

Last updated