Your CI has an AI agent. A stranger's issue can drive it.
You wired an AI agent into GitHub Actions to triage issues and review pull requests. It runs on text anyone can write, and it holds real secrets. agentpipe finds that CI injection chain before an attacker does.
pip install agentpipe-scan$ agentpipe scan . scanning .github/workflows … 3 files ✗ AWI-01 reachable · high untrusted trigger runs an agent with a secret sink .github/workflows/triage.yml:11 ✗ AWI-02 reachable · high untrusted issue title interpolated into the prompt .github/workflows/triage.yml:18 ✗ AWI-05 plausible · high agent runs with --dangerously-skip-permissions .github/workflows/triage.yml:24 4 findings · 4 high · 1 file fix: agentpipe fix . prove: agentpipe prove AWI-01
One opened issue, and your pipeline publishes for a stranger
A workflow triggers on an issue or a pull request. It drops the issue title straight into the agent's prompt. The job holds an npm token and publish rights. Now anyone who opens an issue is handing instructions to a process that can publish your package or leak your keys. No one clicked anything. We call this class clinejection, and it is landing in real repos.
Every exposed chain, across every repo, on one dashboard
The hosted App scans each pull request in real time and records the findings. You get the detector, the verdict, the exact file and line, and the trend over time.
| Repo | Findings | Status |
|---|---|---|
| cyberbobas/agentpipe | 4 | 4 HIGH |
agentpipe fix patches it for you.Three ways to run the same engine
From a one-off check on your laptop to a service that watches your whole organization. One engine, your choice of how much to automate.
CLI
Run a command, read the findings. Nothing to install on a server. Great for a one-off check or trying it out.
pip install agentpipe-scan
agentpipe scan .
agentpipe local
GitHub Action
Add one workflow file. On every pull request a bot posts one sticky comment and uploads results to your Security tab (SARIF).
# .github/workflows/agentpipe.yml
uses: cyberbobas/agentpipe@v0
with:
fail-on: high
comment: true
The hosted App
Install once on your GitHub organization. No workflow files, no server. It watches every repo, comments on pull requests, and gives you a dashboard.
- All repos, current and future
- Real-time PR comments
- Shared dashboard and trend
- Org policy a repo cannot weaken
What the hosted App does that running the CLI cannot
The CLI is a flashlight you point yourself. The hosted App is a smoke detector wired through the whole building. Same engine, very different coverage.
| What | CLI | Action | Hosted App |
|---|---|---|---|
| When it runs | when you type a command | on each PR, per repo | on every PR, whole org, automatically |
| Setup | none, but manual every time | a workflow file in every repo | one click on the org |
| Coverage | one repo, one run | one repo | every repo, current and future |
| Who sees results | only you, in your terminal | on the pull request | the PR and a shared dashboard |
| History and trend | none | none | full history and trend over time |
| Org policy a repo cannot weaken | no | per repo, editable by anyone | yes |
| Maintenance | you run it | you keep the workflow updated | none, managed by us |
You install once. It runs itself.
Install on your org
Pick the repos, or all of them including future ones. One click, no config files.
A pull request opens
Someone opens or updates a PR in any covered repo. GitHub notifies our server over a signed, verified webhook.
We read the workflows
A short-lived token reads only the workflow files at that exact version of the PR. We never touch your source or secrets.
The engine runs
The same static engine traces every untrusted-trigger to agent to sink chain the PR introduces.
One clear comment
A single sticky comment lands on the PR with the chains and the one change that fixes each. Signal, not noise.
It shows on the dashboard
Coverage, what is exposed across repos, and the trend over time. The evidence you show an auditor.
Not a linter. Not a guardrail.
Linters check workflow config. Code scanners check code. Guardrails check the prompt going into the model. No tool traces the untrusted-event to agent to secret chain statically in CI. That is our lane.
Not a linter or code scanner
zizmor and CodeQL flag misconfig and injection in code. We trace the actual link: an untrusted event reaching an AI-agent step that then reaches a secret, write, or publish sink.
Not a guardrail
Guardrails inspect the prompt going into the model. We watch the action the model's step takes in CI. A clean prompt passes a guardrail, then the agent reads a token and publishes. We catch that.
Honest by design
Every finding says what it proves, what it does not, and the one change that fixes it. agentpipe prove confirms it with a harmless canary, never an exploit.
Free while in beta, with fair-use limits
The CLI and the Action are unlimited and open source, forever. The hosted App is free during beta with generous fair-use limits so it stays fast for everyone: PR scans, the dashboard, and org-wide coverage included. Need enterprise policy enforcement or higher volume? Contact us for early access.
Frequently asked
Do you run or store my code?
Is it really free?
Does it work with Copilot, Claude, and other agents?
Will it spam my pull requests?
Can I self-host?
Talk to us, we reply fast
Early access to the hosted App, questions about rollout, or org-wide policy across your whole fleet of repositories. Reach out and we will get back within a business day.
Find the chain before an attacker does
Run it yourself with the free CLI, or install the hosted App once and let it watch every repo, on every pull request, with a dashboard for your whole team.
Security for the AI-agent link in your CI. Part of the Agentoffense suite.