$ man adversarial

How it works

No platform migration, no new dashboard to live in. Adversarial.sh meets your pipeline where it is and stays out of the way until it finds something real.

  1. Connect your pipeline

    Install the GitHub or GitLab app with one click, or add a single step to your existing CI workflow. Scoped, read-only-by-default permissions; write access is limited to patch branches.

  2. Agents fork and scan each pull request

    Every PR spins up an isolated run: agents check out the change, map the attack surface, and draw techniques from a continuously updated library of validated attacks — injection, auth bypass, CI/CD exploitation, supply-chain poisoning, and more.

  3. Findings arrive with severity and proposed patches

    Only confirmed, reachable issues make the cut. Each finding posts as a PR comment with severity, reproduction steps, and a minimal patch — or lands as a ready-to-review branch.

  4. A human approves everything

    Agents propose; humans dispose. Nothing merges without your review. Approve the patch branch, request changes, or dismiss with a reason — the choice is always yours.

  5. It learns your codebase

    Dismissals, approvals, and review feedback tune the models to your stack and your standards. Scan after scan, noise goes down and findings get sharper.

# drop-in integration

One step in your workflow

Prefer explicit CI config over an app install? Add the scan step to any GitHub Actions workflow:

# .github/workflows/adversarial.yml
name: adversarial-scan
on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: read
  pull-requests: write   # post findings as PR comments

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Adversarial scan
        uses: adversarial-sh/scan-action@v1
        with:
          target: pull-request
          severity-threshold: medium   # fail the check on medium+
          open-patch-branches: true
        env:
          ADVERSARIAL_TOKEN: ${{ secrets.ADVERSARIAL_TOKEN }}

GitLab CI, Buildkite, and self-hosted runners are supported with the same one-step model. Talk to us about your setup →