Agentic Workflows | Endor Labs
Agentic workflows
Expert security agents, from finding to fixed
Agentic workflows for vulnerability investigation, triage, and remediation, grounded in application context, and running in the coding agents your developers already use.
AURI Agent Hub
The AURI Agents Hub provides purpose-built security agents for vulnerability discovery, triage, remediation, and incident response. Let's take a look at what you can do.
Solution
Pre-built security agents for triage, remediation, and more
AI SAST Remediation
Every Endor AI SAST finding comes with a case file: data flow, exploit reproduction, verification scorecard, severity scoring. The agent reads it against your source at the pinned commit, works out what's real, and either writes the fix or files the exception.
SCA Remediation
Call graphs show which vulnerabilities you actually reach; upgrade impact analysis shows which of your call paths an upgrade would break. It picks the version that fixes without breaking, makes the change, runs your build, and opens the PR.
Malware Responder
Correlates live supply-chain malware intelligence against your Endor inventory to answer the only question that matters: are you exposed? Returns affected projects, indicators of compromise, and containment guidance.
CI/CD Posture
Scores CI/CD and supply-chain security across a namespace, SCM org, or single repo, combining Endor findings with your repository configuration. Deterministic scores, critical overrides, and a prioritized list of what to fix first.
OSS Upgrade Investigator
Answers "should we take this upgrade?" with Version Upgrade data, Code Impact Analysis, and breaking-change evidence. Shows what each candidate fixes, what it introduces, and whether to move now or wait.
Remediation Planning
Compares every remediation option for your existing findings on findings fixed, upgrade risk, and compatibility, then recommends the safest path forward. A plan before anyone opens a PR.
Results
Context changes the math
Use AURI Agents to perform security tasks faster, cheaper, and more accurately than coding agents working alone. Agents use the AURI security harness to find vulnerabilities, validate reachability and exploitability, and fix without breaking code.
- 12x fewer tokens for the same security work
- 3x more true positives than frontier models
- 19x faster security task completion
How it works
Read it, run it, fork it
Pre-built, open source agents. We already did the work of turning a workflow into an agent. It's all in a public repo, accessible through the Agents Hub, so you can read exactly what an agent does before you let it near your code.
- 11+ workflows ready to run spanning remediation, incident response, posture, and investigation
- Every agent is a markdown file you can open, audit, and fork
- One install works across Claude Code, Codex, Cursor, and Antigravity
- Read-only by default with centralized visibility and approval gates
- Agents run on your infrastructure
Build agents using programmable security capabilities
Your remediation workflow has rules ours might not know about: who approves what, which tickets get filed, what your team will never auto-merge. Agents are generated from source recipes, so you declare that behavior once and it compiles out to every host.
- Define safety class, tool access, and approval gates
- Validators reject unsafe combinations before an agent ships
- Structured JSON output, so results feed whatever you've built
- Propose an agent upstream and it lands in the catalog for everyone
FAQs
What are agentic workflows?
Agentic workflows are multi-step tasks delegated to AI agents that can reason, use tools, and take action toward a goal, rather than just answering a prompt. In security, that means workflows like confirming a vulnerability, choosing a safe fix, and opening a pull request. The quality of an agentic workflow depends on the context the agent can access: an agent with deep knowledge of application behavior and risk produces reliable results, while one working from raw findings alone produces guesses.
What are AURI agents?
AURI Agents are pre-built, open source security agents from Endor Labs that run agentic workflows inside AI coding assistants like Claude Code, Cursor, and OpenAI Codex. Each agent packages a specific workflow, such as remediating vulnerable dependencies or triaging SAST findings, and is grounded in Endor Labs context including reachability analysis and upgrade impact data. Install them from the Agents Hub and invoke them in plain language.
Which AI coding assistants do AURI Agents support?
AURI Agents run in Claude Code, Cursor, OpenAI Codex, and Google Antigravity, installed as a plugin from the associated marketplace. Teams running their own agent runtime can use portable, runtime-neutral agent bundles, and the Cursor SDK supports running workflows programmatically. One install covers all 11 agents in your host of choice.
Does my source code get sent to Endor Labs?
No. Agents run inside your coding assistant, on your infrastructure, using your own LLM keys and source control credentials. Your code and secrets never cross into the Endor Labs boundary, and your token spend stays yours. Only telemetry flows back to the Agents Hub, so security teams get central visibility without the code ever leaving your environment.
Can AURI Agents make changes to my code without approval?
Most agents in the catalog are read-only and cannot edit files, open pull requests, dismiss findings, or write policy on their own. The two agents that can change state, SCA Remediation and AI SAST Remediation, declare exactly what they're allowed to do and keep every mutating action behind a separate approval gate. All changes happen against your own git provider under your own credentials.
How are AURI Agents different from the Endor Labs MCP server?
The MCP server gives your coding assistant access to raw Endor Labs data and scanning capabilities, and is intended to guide coding agents towards secure coding outcomes. AURI Agents package complete security workflows on top of that data: the prompt, the evidence requirements, the approval gates, and the output contract are already built. Use the MCP server for ad hoc scanning in your IDE, and use agents when you want a repeatable workflow like remediation or triage.
Can I build my own security agents?
Yes. The open source Endor Labs Agent Kit defines every agent as a readable source recipe that declares what the agent does, which Endor Labs data it can touch, and what evidence it must produce. A builder compiles each recipe into artifacts for every supported host, and validators reject unsafe combinations before an agent ships. Keep your agents private, or contribute them back to the catalog.
How much do AURI Agents cost?
AURI Agents are free and open source for Endor Labs customers. There's no new runtime to adopt, no new console to buy, and no per-seat pricing; agents use the LLM subscription your team already pays for. Agents require a specific Endor Labs product license (for example, SCA Remediation requires Endor Open Source).