Superagent
← Back to All AI Tools1. Should you try Superagent? Overview
| What it is | Superagent began as an open-source AI agent framework and has pivoted into an AI security service that continuously hunts and patches vulnerabilities in repositories, web apps and agents. |
| Country / HQ | San Francisco, USA (Y Combinator-backed) |
| Best for | Engineering and security teams that want continuous, agent-driven vulnerability research and auto-generated fix PRs rather than annual pen tests. |
| Check before buying | The security product is priced per private repository; the older open-source agent SDK (MIT) is separate and no longer the main product. |
| Editor rating | 4.0 / 5 |
| Pricing signal | Free for public repos; paid per private repo |
2. Features What it does
| Feature | What it does |
|---|---|
| Agent framework lineage | Open-source SDK (MIT) with memory, tool use, web browsing and multimodal support that powered early agent deployments. |
| Continuous vulnerability research | Agents keep probing connected repos on a schedule, chaining weaknesses the way a real attacker would. |
| Auto-fix pull requests | Opens PRs that patch discovered vulnerabilities for engineers to review and merge. |
| PR-time scanning | New code is checked for vulnerabilities whenever a pull request opens or updates. |
| Triage and disclosure | Sorts real issues from noise, including inbound reports, and hands you CVE/advisory ownership. |
| Contributor trust scoring | Flags risky contributors before their code merges. |
| CI integration | Hooks into CI and pull requests so findings land in the review workflow your team already uses. |
3. Pricing Pricing (2026-10, USD)
| Plan | Price / mo | Key limits & who it fits |
|---|---|---|
| Public repos | $0 | Free forever for open-source repositories on GitHub. |
| Private repos | $10,000/repo/yr | Per connected repository, billed annually; includes scanning, research, triage and fix PRs. |
| Custom | Custom | Incident response, one-off audits and scoped research campaigns via sales call. |
Sources disagree because of the pivot: the historical open-source agent framework is free (MIT), while the current security service is priced per private repo. Verify scope on superagent.sh before buying.
4. Integration Access & integrations
| Access type | Details |
|---|---|
| Platform | Web service connected to GitHub repositories; CLI for setup. |
| Code hosting | GitHub (public and private repos). |
| Workflow | CI pipelines and pull-request reviews. |
| Legacy SDK | Node/TypeScript SDK, REST API, hosted vector memory (historical open-source framework). |
5. Reviews & Sources External reviews
| Source | Rating | What it says |
|---|---|---|
| G2 (framework era) | 4.0 / 5 | Reviewers liked the lightweight, developer-first agent framework; noted it lacked built-in governance and observability. |
| dotenvx maintainer | Positive | Superagent agents chained vulnerabilities into a real kill chain and patched them before a commercial scanner flagged the same issue. |
| Capchase engineer | Positive | Appreciated real guardrails while engineering work continues, though noted nothing is airtight. |
6. Best for / Not for Fit
| ✔ Suitable | ✘ Not suitable |
|---|---|
| • Open-source maintainers who want free, continuous security review • Startups without a dedicated AppSec team • Teams that want fixes as reviewable PRs, not scanner reports |
• Teams looking for the original agent-building framework for new products • Orgs needing per-seat or usage-based pricing rather than per-repo fees • Companies outside GitHub-centric workflows |
7. Competitors How it compares
| Competitor | How it differs | Best for |
|---|---|---|
| Snyk | Snyk is a mature commercial SAST/SCA scanner; Superagent runs autonomous research agents that patch issues for you. | Enterprises wanting broad, compliance-grade scanning. |
| GitHub Advanced Security | Native GitHub integration at org scale; Superagent adds deeper adversarial research and auto-fix PRs. | GitHub-first orgs wanting built-in coverage. |
| Latta AI / bug-hunting agents | Similar agent-driven debugging, but Superagent focuses on proactive vulnerability hunting. | Teams comparing autonomous security agents. |
8. Summary Verdict
| Takeaway | A credible autonomous security layer for GitHub repos: genuinely free for open source, but per-repo private pricing demands real security ROI. |
| Who should pick it | OSS maintainers and lean engineering teams that ship fast and want continuous adversarial review. |
| Who should skip it | Teams that need traditional compliance-driven scanning breadth or that wanted the old open-source agent framework for new builds. |