We shipped agentpipe v0.9, and it is a big one. agentpipe started life as a local CI/CD security scanner you ran by hand from a terminal. It now lives inside your pipeline and reviews every pull request automatically.
What is new in agentpipe v0.9
GitHub Action and SARIF output
One line in your workflow and agentpipe reviews every PR. It posts a single, updatable comment with the attack chains that PR introduces, and uploads results as SARIF straight to your Security tab (Code Scanning). Baseline mode stays silent on existing debt and speaks only for what a PR adds, so it never spams the review.
Autofix with agentpipe fix
agentpipe fix writes safe, round-trip patches. Your comments and formatting survive. Anything intent-specific is left as advice, never an unsafe auto-edit, and it is dry-run by default, so nothing changes without your call.
Repo and org policy as code
A repository carries its own policy in .github/agentpipe.yml: which detectors are on, which paths are excluded. A security team then sets an org-wide policy that a single repo cannot loosen with a quiet commit. That is the foundation of the company layer: one set of rules across every repository.
Why it matters
The clinejection class, where untrusted input from an issue or a pull request reaches a step that holds your secrets, is cheapest to catch before merge. We walked through real cases of it in our roundup of 10 real AI agent vulnerabilities of 2025, from the tj-actions CI secret leak to the s1ngularity attack that stole a publish token through a vulnerable workflow. agentpipe now catches that chain right at PR review, not after an incident.
How to add it
Locally it is still one command:
pip install agentpipe-scan
agentpipe scan . # this repository
agentpipe fix . # safe autopatches, dry-run by default
agentpipe local # audit this machine's agent configThe ready GitHub Action snippet and full docs live in the GitHub repository, and the per-version list of changes is in the CHANGELOG. The scanner, the Action, fix and prove are free and open source (MIT). Org-wide continuous scanning with a dashboard, alerts and an enforced org policy is the paid layer for companies.
agentpipe is the first of three lines
agentpipe finds the hole in CI before it ships. The rest of the set runs alongside it: airlock_ai, a firewall that blocks the dangerous call at runtime, and countersign, an honest human gate. We break down how the three lines cover each other’s blind spots in three lines of defense for AI agents.
Want an attacker’s view of your pipelines, or help wiring agentpipe across every repo in your org? That is our day job: AI agent penetration testing. To talk it through, get in touch.