Agent quickstart

One URL onboards an agent from nothing. It installs the CLI, gets the user signed in, connects the repository, and finishes by installing the full skill so the agent knows how to use Cefense from then on.

Three steps

1. 1
   Point the agent at the setup document

   Paste this into Claude Code, Cursor, Codex, or anything else that can read a URL and run commands.

   Set up Cefense in this repo: cefense.com/skill.md

2. 2
   Sign in when it asks

   Signing in is OAuth in a browser, so the agent cannot do it alone. It will ask you to run cf auth login and will wait, polling cf auth status until you are through. If your provider is not connected yet, it will send you to the workspace to do that.

3. 3
   Ask for a scan

   Once the repository is connected, ask in plain language. The agent already knows the commands.

   Scan this repo with Cefense and show me the highest severity finding.

What the agent does on your behalf

1. Checks whether cf is installed and you are already signed in, and skips ahead if so.
2. Installs @cefense-npm/cefense-cli globally, or falls back to running it through npx if it cannot.
3. Waits for you to sign in, rather than asking you for a token. It will never ask for one.
4. Connects the repository by name and queues its first scan.
5. Polls until the scan finishes, then runs cf skill install so every coding agent configured in the repository gets the full instructions.

Verifying it worked

$cf status --agent{"schemaVersion":1,"ok":true,"command":"status","data":{  "email":"you@example.com",  "github":{"connected":true,"login":"acme-eng"},  "repositories":[{"repository":"acme/api","scan":{"status":"completed","findings":31}}]}}

cf skill list confirms which agent files were written. They are part of the repository and belong in a commit, so everyone's agent gets the same instructions.

If you are on more than one team

Repositories and findings belong to an organization, which is the shared workspace for a team. If your account belongs to exactly one, nothing here is needed. If it belongs to several, pick one so commands know which team to act on.

cf org list
cf org use acme

Doing it yourself instead

npm install -g @cefense-npm/cefense-cli
cf auth login
cf repo connect acme/api
cf skill install