Skip to main content

​
The Path to Autonomous Security

Corgea’s vision is to make application security fully autonomous — handling the heavy lifting so you can focus on building. Our platform already detects vulnerabilities, reduces false positives, and generates AI-powered fixes automatically. But some tasks still require a developer or security engineer to act on findings, apply fixes, and verify results. That’s where Corgea’s agentic integrations come in. By connecting Corgea directly to the AI coding agents you already use — like Cursor, Claude Code, GitHub Copilot, and OpenAI Codex — you give those agents the context and capabilities they need to handle security tasks on your behalf. The result is a development workflow where security issues are not only found but also resolved with minimal manual effort. Corgea offers two powerful agentic integrations: Corgea Agent Skill and Corgea MCP.

​
Corgea Agent Skill

Agent Skills are an open format for giving AI agents new capabilities. A skill is a structured set of instructions, commands, and context that an agent can discover and use on demand — think of it as a playbook that teaches your agent how to interact with a specific tool. The Corgea Agent Skill teaches your coding agent how to use the Corgea CLI to scan code, list issues, inspect vulnerabilities, view AI-generated fixes, and apply them — all from within your development environment. Unlike MCP (which provides read access to Corgea data), the Agent Skill gives your agent the ability to take action: run scans, retrieve diffs, and apply fixes directly to your codebase. Agent Skills are supported by leading AI development tools including Cursor, Claude Code, OpenAI Codex, GitHub Copilot, VS Code, Roo Code, Windsurf, and many more.
Corgea Agent Skill interaction in Cursor

Corgea Agent Skill in action — scanning and fixing vulnerabilities directly from Cursor

​
Prerequisites

Before installing the skill, you need the Corgea CLI installed and authenticated on your machine. The skill relies on CLI commands like corgea scan, corgea ls, and corgea inspect to interact with Corgea.

Install the Corgea CLI

Follow the CLI installation and authentication guide to get set up.

​
Skills Registry

Use the Skills Registry in Corgea to create and manage company-authored Agent Skills for your teams. Add a SKILL.md, optionally provide a version, and submit it for review. Each version is reviewed independently before it becomes installable. Only approved skill versions can be installed through the CLI. Pending, rejected, or failed versions remain visible in the registry so your team can review status, notes, and previous versions before submitting an update.

​
Install with npx skills

The maintained public skill is corgea-scan in the first-party Corgea/skills repository. The Skills CLI runs through npx, so you do not need to install it globally. It requires Node.js 18 or later and npm.
The Skills CLI installs the instructions that teach your agent how to use Corgea. It does not install or authenticate the Corgea CLI itself. Complete the Corgea CLI prerequisites first.
Run the command from the root of the repository you want to scan. Choose the scope that matches how you work:
Install the skill for agents working in the current repository:
Project scope is the default. Use it when the skill should be repository-specific. Commit the generated skill files if other contributors should receive them when they check out the project.
By default, the installer detects supported agents and asks where to install the skill. Use one or more --agent flags when you want an explicit, repeatable target:
Agent IDs include claude-code, cursor, codex, opencode, github-copilot, windsurf, and many more. For an unattended installation, add --yes:
The installer normally offers to link agents to a shared copy of the skill. If your environment does not support symlinks, add --copy to create independent copies instead.
Verify, update, or remove the skill
Use the Skills CLI to inspect and maintain the installation:
If your coding agent was already running during installation, restart it or open a new session. Then ask:
Scan this repository with Corgea.
The agent should load corgea-scan, confirm that the Corgea CLI is available and authenticated, and start the scan from the current repository.
Run npx skills list to confirm the project installation or npx skills list --global for a global installation. If you selected a specific agent, verify it with npx skills list --agent <agent>. Reinstall with the correct --agent and scope, then restart the agent.
The skill depends on the Corgea CLI. Run corgea --version and corgea login, then repeat your request. See the CLI installation guide for platform-specific setup.
Remove it from the current scope, then reinstall it in the intended scope:

​
Installation

For the public Corgea Agent Skill, the skill file is hosted on GitHub:
The fastest way to install it is with the Corgea CLI, which fetches the approved skill from the Corgea registry and places it in the right directory for your agent:
This installs into the current project for your configured default agent. Target a specific agent with --agent (e.g. cursor, claude-code, codex — see the CLI reference for all supported agents), choose --scope project or --scope user, or install to a custom path with --dir. Set a default agent for future installs with corgea skill set-default-agent <agent>:
To place the file yourself instead, choose your agent below for the manual steps.
Cursor discovers skills from SKILL.md files placed in designated directories. To install the Corgea skill:
  1. Create the skills directory in your project or home folder:
  1. Download the skill file:
Once placed, Cursor automatically loads the skill in Agent mode when your request matches a security task. You can also explicitly invoke it using @corgea in the chat.For project-level skills shared with your team, place the file in .cursor/skills/corgea/SKILL.md within your repository instead.

​
Skills Marketplace

Corgea also publishes an open marketplace of agent skills at github.com/Corgea/skills. It covers more than the CLI skill above — including skills for tools that run entirely on your machine — and installs into any of the 70+ agents that support the Agent Skills format. Install a single skill with the skills CLI:
Claude Code users can add the whole marketplace as a plugin instead, which makes every skill available at once:
The marketplace is the right choice when you want Sighthound, or when you’d rather manage skills as a set. To install just the Corgea CLI skill, corgea skill install corgea above is fewer steps and pulls the version approved in your Corgea registry.

​
Use Cases

When Corgea scans your pull request and reports vulnerabilities, you no longer need to manually inspect each finding and write fixes. Open your coding agent (Cursor, Claude Code, etc.) and ask it to fix the issues:
“Fix all the security issues Corgea found in my latest PR scan.”
The agent will automatically connect to Corgea, list the issues for your scan, retrieve the AI-generated diffs, and apply the fixes to your codebase — all in one step.
When you’re rapidly iterating on code with AI assistance (vibe coding), security can easily slip through the cracks. Use the agent to run a security check before every commit:
“Scan my uncommitted changes for security issues and fix anything you find.”
The agent will run corgea scan --only-uncommitted, review the results, and apply fixes — ensuring your fast-moving code stays secure without slowing you down.
Focus the scan on the files or directories you’ve been working on:
“Scan the src/auth/ directory for security vulnerabilities.”
The agent runs a targeted BLAST scan using --target src/auth/, reviews the findings, and can apply fixes on the spot.
When you want to understand a finding before deciding whether to fix it:
“Show me the details and fix for issue ISSUE_ID.”
The agent retrieves the full issue details, explains the vulnerability, and presents the AI-generated fix with a diff — letting you make an informed decision.

​
Corgea MCP

The Model Context Protocol (MCP) is an open standard that lets AI agents securely connect to external tools and data sources. Corgea’s MCP server exposes your scan results, vulnerability details, SCA findings, and blocking rules directly to any MCP-compatible agent. With Corgea MCP, your AI agent can query scan results, retrieve issue details, list vulnerabilities filtered by severity or project, and check policy configurations — all without you having to copy-paste data or switch between tools.

Corgea MCP Setup Guide

Full setup instructions, available tools, and client configuration for Claude Desktop, Cursor, and more.

​
Use Cases

  • Contextual code review: Ask your agent “What critical vulnerabilities were found in the last scan?” and get actionable answers grounded in real scan data.
  • Vulnerability triage: Let the agent prioritize which issues to fix first based on severity, exploitability, and your organization’s blocking rules.
  • Remediation planning: Ask the agent to generate a fix plan for all open high-severity issues in a specific project or scan.
  • Dependency risk assessment: Query SCA findings to understand which third-party libraries have known vulnerabilities and what versions to upgrade to.

​
Agent Skill vs. MCP — When to Use Which

Use both together for the most comprehensive experience: the Agent Skill for taking action on findings, and MCP for querying and understanding your security posture.

​
Getting Started

1

Install the Corgea CLI

Follow the CLI installation guide to install and authenticate.
2

Install the Corgea Agent Skill

Add the Corgea skill to your coding agent using the installation instructions above.
3

Set up Corgea MCP

Connect your AI agent to Corgea’s MCP server for security data access. See the MCP setup guide.
4

Start using it

Ask your agent to scan your code, review findings, and apply fixes — all from natural language.