You wired an AI agent into GitHub Actions to triage issues and review pull requests. It runs on text anyone can write, and it holds real secrets. agentpipe finds that chain before an attacker does.
A workflow triggers on an issue or a pull request. It drops the issue title straight into the agent's prompt. The job holds an npm token and publish rights. Now anyone who opens an issue is handing instructions to a process that can publish your package or leak your keys. No one clicked anything. We call this class clinejection, and it is landing in real repos.
The hosted App scans each pull request in real time and records the findings. You get the detector, the verdict, the exact file and line, and the trend over time.
Real dashboard from the live App. Static analysis only, no exploit is ever run.
Every finding carries the verdict, the exact file and line, the one change that fixes it, and the real incident it maps to.
From a one-off check on your laptop to a service that watches your whole organization. One engine, your choice of how much to automate.
Run a command, read the findings. Nothing to install on a server. Great for a one-off check or trying it out.
Add one workflow file. On every pull request a bot posts one sticky comment and uploads results to your Security tab (SARIF).
Install once on your GitHub organization. No workflow files, no server. It watches every repo, comments on PRs, and gives you the dashboard.
The CLI is a flashlight you point yourself. The hosted App is a smoke detector wired through the whole building. Same engine, very different coverage.
| CLI (free) | Action (free) | Hosted App | |
|---|---|---|---|
| When it runs | when you type a command | on each PR, per repo | on every PR, whole org, automatically |
| Setup | none, but manual every time | a workflow file in every repo | one click on the org |
| Coverage | one repo, one run | one repo | every repo, current and future |
| Who sees results | only you, in your terminal | on the pull request | the PR and a shared dashboard |
| History and trend | none | none | full history and trend over time |
| Org policy a repo cannot weaken | no | per repo, editable by anyone | yes |
| Maintenance | you run it | you keep the workflow updated | none, managed by us |
Short version: the CLI answers "is this repo exposed right now, if I check." The App answers "is anything across our whole org exposed, ever," without anyone lifting a finger.
Pick the repos, or all of them including future ones. One click, no config files.
Someone opens or updates a PR in any covered repo. GitHub notifies our server over a signed, verified webhook.
A short-lived token reads only the workflow files at that exact version of the PR. We never touch your source or secrets.
The same static engine traces every untrusted-trigger to agent to sink chain the PR introduces.
A single sticky comment lands on the PR with the chains and the one change that fixes each. Signal, not noise.
Coverage, what is exposed across repos, and the trend over time. The evidence you show an auditor.
Linters check workflow config. Code scanners check code. Guardrails check the prompt going into the model. No tool traces the untrusted-event to agent to secret chain statically in CI. That is our lane.
zizmor and CodeQL flag misconfig and injection in code. We trace the actual link: an untrusted event reaching an AI-agent step that then reaches a secret, write, or publish sink.
Guardrails inspect the prompt going into the model. We watch the action the model's step takes in CI. A clean prompt passes a guardrail, then the agent reads a token and publishes. We catch that.
Every finding says what it proves, what it does not, and the one change that fixes it. agentpipe prove confirms it with a harmless canary, never an exploit.
The CLI and the Action are unlimited and open source, forever. The hosted App is free during beta with generous fair-use limits so it stays fast for everyone: PR scans, the dashboard, and org-wide coverage included. Need enterprise policy enforcement or higher volume? Contact us for early access.
agentpipe reports preconditions, not proof of exploitation. It analyzes GitHub Actions and local agent configs, statically. It does not run your agent and it does not stop prompt injection. Every report ends with what the scan cannot see, which is exactly where a real pentest begins.
Run it yourself with the free CLI, or install the App once and let it watch every repo, on every pull request, with a dashboard for your whole team.