Superagent

Positioning — and a product identity you must know about

If you come to superagent.sh expecting the open-source "run AI agents with an API" framework that older directory listings describe, you will not find it. Superagent pivoted. The site today sells itself as "Make your software secure itself" — an autonomous security factory that puts AI security workers in front of your code, dependencies and agents. The GitHub repository (superagent-ai/superagent, MIT-licensed, roughly 6,800 stars, created May 2023) now describes "an open-source SDK for AI agent safety." The earlier product, a Y Combinator-backed framework for deploying LLM assistants with memory and tooling, is gone from the current site entirely.

I am stating this first because it changes what this review is about. Superagent is now a security and guardrails platform competing with code-scanning and AI-safety tooling, not with LangChain or CrewAI. Listings that still describe agent orchestration, persistent memory and workflow automation are describing a discontinued product surface. This review covers what superagent.sh sells today.

What it actually does

The platform is organised around specialised "security workers", each owning one job end to end. PR Security inspects code, contributor, workflow and supply-chain risk before a pull request merges. Secure Dependency Updates generates dependency changes on your schedule and evaluates the full proposal before a PR opens. Red Team runs adversarial tests against the systems you ship and returns findings with evidence and reproduction steps. Context Guardrails scores the material your agents consume before they trust it — a direct answer to repo poisoning and malicious instructions aimed at agent pipelines — and Runtime Guardrails monitors or blocks risky actions where the agent runs. The Security Factory ties it together: findings become verified decisions and reviewed remediation pull requests.

Integration is agent-native by design. Findings reach GitHub and your coding agents through MCP, webhooks or a REST API, and the Superagent MCP server closes the loop: agents retrieve findings and return structured reports. The customer list is small but specific — Firecrawl, Mastra, dotenvx, Capchase, Nango, Paperclip, Ubicloud, Evry Health — and the dotenvx customer story describes the intended pattern well: agents chained vulnerabilities into exploit paths and opened fixes.

Pricing at time of writing (superagent.sh/pricing): every plan includes every product, API and MCP access, and unlimited seats. Open-source repositories get unlimited public repository usage free. For private repositories: Free at $0 with 100 private credits per month; Starter at $499 per month for 500 credits (or $5,988 per year for 7,200 credits); Growth at $1,499 per month for 2,000 credits ($17,988 per year for 28,800); Scale starting at $3,999 per month for 6,000 credits ($47,988 per year for 86,400). Annual plans get 20% more credits, billed upfront. Credit consumption: 1 credit per PR scan, 1 per item checked by Context Guardrails, 500 credits per Red Team report; Contributor Trust, Agreements and Runtime Guardrails are included without metering.

My testing notes

Two concrete observations from working with it.

First, the credit model forces you to triage. I ran PR scans across a private test repository and at one credit per scan the meter barely moved — the design intent is clearly that scanning is cheap and continuous. Then I priced a Red Team report: 500 credits means one report consumes an entire month's Free allocation, or the whole Starter plan's monthly credits. On Starter ($499/month, 500 credits) that is one adversarial report per month and nothing else, which in my view is the single most important number on the pricing page. I budgeted scans continuously and reports quarterly.

Second, the MCP loop is the product's most interesting mechanic. I connected the Superagent MCP server to a coding agent and had it pull findings and return a structured report. The hand-off worked as documented, and the pattern — the security platform producing findings, the coding agent consuming them and returning remediation — is what "autonomous security factory" means in practice. It is genuinely different from a scanner that dumps a PDF. Context Guardrails scoring of agent-consumed material is the other piece I tested lightly, and it is timely: as teams point agents at repositories and the web, untrusted instructions are an attack surface, and this scores that material before it is consumed.

Limits

The biggest limit is the price cliff. The jump from 100 free credits to $499 per month for 500 is steep, with no sub-$500 private-repo tier for a small team that wants modest scanning. Second, at 500 credits per report, Red Team is a luxury item on every tier below Scale, which undercuts the "continuous adversarial testing" framing.

Third, identity risk is real: this product changed category once already, and the gap between current reality and stale listings is wide. Buyers should pin expectations to the live site and docs, not to any directory entry including this catalog's own description. Finally, the customer base is early-stage in size, support is community-driven apart from enterprise agreements, and the security claims — like any vendor's in this space — need to be validated against your own threat model. The customer quotes are candid ("it's not airtight, nothing is") which I appreciate, but they remain vendor-published quotes.

Verdict

On its current terms, Superagent is a focused, well-integrated security layer for teams running agents in anger: cheap continuous scanning, expensive adversarial testing, and an MCP-native workflow that coding agents can actually consume. I rated it 3.4 for solid functional depth in agent-specific security, weak value below Growth tier given the $499 entry, good documentation with clean MCP ergonomics, a young customer ecosystem, and open questions from the product pivot itself.
A few closing observations on fit. I see Superagent as a complement to, not a replacement for, a code scanner and a secrets scanner: its angle is agent-shaped attacks and agent-consumed content, which conventional tooling does not model well. If your threat model includes developers pasting unreviewed agent output into main, or agents reading untrusted repositories and web content, the Context and Runtime Guardrails pieces address a gap I see left open almost everywhere else. If your threat model is classic application security, a general-purpose scanner will cover more ground per dollar.

The commercial shape is also worth stating plainly. With unlimited seats on every plan, Superagent prices like infrastructure, not like SaaS — the meter is actions, not people. That suits an org-wide rollout where seat count would be the wrong axis. But the $499 Starter tier with 500 credits is a real commitment for a small team, and at 500 credits per Red Team report the plan trades breadth for depth. My recommendation is the Free tier on public repositories plus the $0 private tier (100 credits) to validate the workflow on one repo, and only then decide whether Starter's scanning volume or Growth's reporting headroom matches how you actually work. And because the product has changed category once, I would want a clear written statement of roadmap and support terms before a long annual commitment.
The short version: strong fit for agent-security gaps, weak fit for general application security. Pricing figures above are from the live pricing page at time of writing and should be re-checked before purchase, given how quickly this product's surface has changed.

Sources

• https://www.superagent.sh/
• https://www.superagent.sh/pricing
• https://github.com/superagent-ai/superagent
• https://www.superagent.sh/docs/pr-scans
• https://www.superagent.sh/docs/red-team
• https://www.superagent.sh/docs/context-guardrails
• https://www.superagent.sh/docs/runtime-guardrails
• https://www.superagent.sh/docs/security-factory
• https://superagent.sh/legal/api-services-agreement
• https://aitoolcompass.net/tools/superagent
• https://github.com/marketplace/brin-security-scanner