Agent Setup Guide

1. Get Your License Key

Sign up at the dashboard, then go to License Keys and generate a new key. Save it securely — it's only shown once.

2. Run the Agent

Pull and run the Docker image on your infrastructure:

docker run -d \
  --name security-review-agent \
  -e AGENT_LICENSE_KEY=sra_live_your_key_here \
  -e GITLAB_URL=https://gitlab.example.com \
  -e GITLAB_PAT=glpat-xxxxxxxxxxxx \
  -e LLM_PROVIDER=anthropic \
  -e ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxx \
  -e WEBHOOK_SECRET=your-webhook-secret-min-16-chars \
  -e DATABASE_URL=sqlite+aiosqlite:////data/security-review.db \
  -v agent-data:/data \
  -p 8000:8000 \
  ghcr.io/your-org/security-review-agent:latest

3. Configure GitLab Webhooks

In your GitLab project or group settings, add webhooks pointing to your agent:

• Merge Request events: https://your-agent-host:8000/webhook/merge-request
• Note (comment) events: https://your-agent-host:8000/webhook/comment

Set the Secret token to the same value as your WEBHOOK_SECRET environment variable.

4. Verify It's Working

Open a merge request in your project. The agent will automatically post security review comments on the MR.

Check the agent health endpoint: GET https://your-agent-host:8000/health

Environment Variables Reference