Corgea Agent

AI-powered assistant for managing security vulnerabilities in your codebase

Overview

Corgea Agent is an AI-powered assistant that helps you manage security vulnerabilities in your codebase. It provides two main interaction modes:

1. Web Chat Interface - An interactive chat for exploring security issues, scans, and vulnerability data
2. Pull Request Comments - Automated responses to commands in PR comments across GitHub, GitLab, Azure DevOps, and Bitbucket

---

Getting Started

Prerequisites

Before enabling Corgea Agent, ensure you have:

• Active Corgea account with appropriate plan access
• At least one integration configured (GitHub, GitLab, Azure DevOps, or Bitbucket)
• Webhook events properly configured for your repository

Initial Setup

1. Enable Corgea Agent

   Navigate to Settings → Automation → Corgea Agent in your Corgea dashboard and toggle the “Enable Corgea Agent” switch to activate the agent. Once enabled, the agent will begin monitoring PR comments and be available for chat.

   
2. Verify Permissions

   Ensure your Corgea integration has necessary permissions to:

   • Read pull request comments
   • Post comments on pull requests
   • Access repository content

   Check your integration settings to confirm webhooks are active.

3. Test the Connection

   • Create a test PR with a security issue
   • Comment hello on any vulnerability in the PR to verify the agent responds
   • Access the web chat interface to ask a question about your scans

---

Web Chat Interface

Accessing the Chat

Open Corgea Agent in the sidebar to access the interactive AI assistant.

What You Can Do

The Corgea Agent has deep knowledge of your security posture and can help you:

Explore Security Issues

Get detailed information about specific vulnerabilities, understand severity levels, and review fix suggestions

Analyze Scans

Review scan results and summaries, compare scans over time, and understand scan coverage

Query Vulnerability Data

List issues by severity, project, or type, and review blocking rules and policy violations

Example Queries

Example Chat Queries

"Show me all critical issues in my latest scan"
"What are the details for issue abc-123?"
"List all SQL injection vulnerabilities in project XYZ"
"Explain the security implications of CVE-2024-12345"
"What blocking rules are currently active?"

Be specific in your queries for better results. Reference issue IDs, scan IDs, or project names directly for more accurate responses.

Documentation, Charts, and Downloads

Ask the agent how to use Corgea features. It can consult Corgea documentation and include relevant links and screenshots in its answers.

You can also ask for charts of scans, scan duration, findings introduced versus resolved, average time to fix by severity, open code findings by severity, or the most common open finding types. Specify a project and time range when relevant. Charts require reporting permission and a plan that includes reporting, and use only projects you can access.

Ask for a CSV download of a completed scan’s security or code quality findings. Dependency exports are also available. Downloads respect your scan and project access.

To return to a conversation, open it from chat history or bookmark its URL. You can open a history link in a new tab. Conversations are private to your account within your current company.

Context Documents

Company admins can add guidance under Settings → Automation → Corgea Agent → Context Documents. Use these documents for your organization’s processes, policies, and coding standards; the web chat agent reads relevant enabled documents when answering.

Choose Add document, enter a title and content, and optionally describe when the document should be used. Content can be plain text or Markdown, up to 50,000 characters per document. Each company can store up to 50 documents. Admins can edit, enable, disable, or delete them.

Context documents guide answers; they do not grant permissions or bypass triage approvals.

---

Pull Request Interactions

How It Works

When Corgea detects security issues in a pull request, the agent automatically:

1. Posts comments highlighting the vulnerabilities
2. Monitors the PR for developer responses
3. Interprets developer intent from comments
4. Takes automated actions based on commands

Acknowledgements and Fix Feedback

On GitHub and GitLab, a successfully recorded status change or fix-feedback comment is normally acknowledged with a 👍 reaction instead of a text reply. This means the action was recorded, including negative feedback about a fix. Questions, requests for a reason, and refused actions still receive text replies. If the reaction cannot be added, Corgea falls back to a text reply.

With Corgea Agent enabled, react with 👍 or 👎 to Corgea’s finding comment to give feedback on the suggested fix. These reactions vote on the fix; they do not change the finding’s status. GitHub reactions may take a few minutes to appear in Corgea. For GitLab, enable the Emoji events webhook trigger. Reaction feedback is visible in Feedback History.

If the agent declines to change a finding’s status or request another fix from a comment, use the Corgea app to perform that action.

Triggering the Agent

The agent responds to comments that:

• Explicitly mention @Corgea
• Reply directly to Corgea’s issue comment
• Contain recognizable action commands
• Are directed at addressing security findings

You don’t need to use @Corgea as the agent will respond to comments to it’s own.

Supported Actions

Mark as False Positive

Explain why the reported issue is not a real vulnerability. A bare “false positive” request is not enough; Corgea asks for more detail and leaves the issue unchanged until you provide a meaningful reason. See Triage Justifications.

Example Comments:

@Corgea false positive, the query is parameterized on line 44
This is not a real issue, that input is the signed JWT claim
@Corgea this is safe, the value never leaves our allowlist

What Happens:

• Issue is marked as “False Positive”
• Issue is removed from blocking status
• Feedback is recorded for analysis

Mark as Accepted Risk

Acknowledge a real vulnerability but accept the risk without immediate remediation.

Include the reason. A bare “accept risk” is answered with a request for one—see Triage Justifications.

Example Comments:

@Corgea accept risk until the 2.0 upgrade next quarter
We accept this, the endpoint is internal-only behind the VPN
@Corgea won't fix, this service is decommissioned in March

What Happens:

• Issue status changes to “Accepted Risk”
• Issue no longer blocks PR
• Risk acceptance is logged

Mark as Fixed

Confirm that a vulnerability has been resolved.

Example Comments:

@Corgea fixed
Already fixed this in the latest commit
@Corgea this is resolved

What Happens:

• Issue status changes to “Fixed”
• Issue no longer appears in active findings
• Fix confirmation is recorded

Mark as Duplicate

Flag an issue as a duplicate of an existing finding.

Example Comments:

@Corgea duplicate
This is a duplicate of issue XYZ
Same as #456

What Happens:

• Issue is marked as duplicate
• Linked to original issue (if specified)
• Removed from active count

Mark as In Progress

Indicate that work is underway to fix the issue.

Example Comments:

@Corgea fix in progress
Working on this now
We're fixing this in the next commit

What Happens:

• Issue status changes to “Fix In Progress”
• Tracked as actively being addressed
• Team can monitor progress

Request More Information

Ask Corgea for additional details about a vulnerability.

Example Comments:

@Corgea explain this issue
What's the security impact here?
Can you provide more context?

What Happens:

• Agent provides detailed explanation
• Includes vulnerability context and remediation guidance
• May suggest related resources

Comment Interaction Examples

False Positive

Scenario: Developer disagrees with finding

PR Comment

This input is already sanitized in the middleware layer, false positive

Agent Response:

✅ Marked as False Positive
This issue has been marked as a false positive based on your feedback. 
The issue will no longer block this PR.

Accepted Risk

Scenario: Accepting risk for legacy code

PR Comment

This is legacy code we're deprecating next quarter. Accept the risk

Agent Response:

⚠️ Marked as Accepted Risk
This issue has been acknowledged as an accepted risk. 
It will no longer block this PR, but will remain in your security dashboard for tracking.

Dismissal Without a Reason

Scenario: Developer asks to dismiss a finding but does not say why

PR Comment

@Corgea false positive

Agent Response:

I can't record that without a reason. Tell me what makes this safe - the
validation or control in the way, or why the path can't be reached - and
I'll mark it.

The status is left unchanged. Reply with the reason and the agent records the decision.

Request Context

Scenario: Developer needs clarification

PR Comment

Can you explain why this is considered an SQL injection vulnerability?

Agent Response:

[Detailed explanation of the SQL injection risk, 
code examples, and suggested remediation approaches]

Feedback History

View all PR comment interactions in the Feedback History tab under Settings → Automation → Corgea Agent:

• See all actions taken via PR comments
• Open an entry to view the original comment, AI reasoning, and the agent response in one place
• Filter by action type, user, or date range
• Monitor team engagement with security findings

Available Filters:

• Action Type (False Positive, Accepted Risk, Fixed, etc.)
• GitHub/GitLab/Azure DevOps user
• Date range

---

Supported Platforms

Corgea Agent works seamlessly across multiple development platforms:

GitHub

• Pull request comments
• Issue comments
• Review threads

Requires: GitHub App installation with appropriate permissions

GitLab

• Merge request comments
• Note threads

Requires: GitLab integration with webhook configuration

Azure DevOps

Requires: Support is coming soon

Bitbucket

• Pull request comments
• Inline discussions

Requires: Bitbucket integration with webhook configuration

---

Troubleshooting

Agent Not Responding to PR Comments

Check:

• Is the agent enabled in Settings → Automation → Corgea Agent?
• Are webhooks properly configured for your repository?
• Did you mention @Corgea or reply to an agent comment?
• Is your integration active and properly authenticated?

Solution:

• Verify webhook delivery in your platform’s webhook settings
• Check integration status in Corgea dashboard
• Re-authenticate if needed

Action Not Applied to Issue

Check:

• Does your comment clearly state the intended action?
• Are you commenting on the correct issue?
• Do you have permissions to modify issues?

Solution:

• Use explicit commands like “@Corgea false positive, the input is escaped by the template engine”—a dismissal needs a reason
• Check the Feedback History to see how your comment was interpreted

Chat Not Loading or Responding

Check:

• Browser console for JavaScript errors
• Network connectivity
• Account permissions

Solution:

• Refresh the page
• Clear browser cache
• Contact support if issue persists

---

Best Practices

PR Comments

One Action Per Comment: Keep comments focused on a single action

Provide Context: Add reasoning to help the team understand your decision

Review Feedback History: Periodically check how your commands are interpreted

Web Chat

Use Specific Identifiers: Reference issue IDs, scan IDs, or project names

Ask Follow-Up Questions: Drill deeper into topics with contextual queries

Leverage Search: Filter results by severity, type, or status

Save Important Queries: Keep track of useful queries for recurring analysis

---

Privacy & Security

All chat interactions are scoped to your company’s data. The agent only accesses information your user account has permission to view.

• PR comment actions are logged and auditable in Feedback History
• Agent responses never expose sensitive credentials or internal implementation details
• Data is processed in compliance with Corgea’s security standards

---

Support

Need help with Corgea Agent? Contact us at [e-mail]