Agents

An agent combines a model, skills, guardrails, and tools into a configuration you can run. Retrieve an existing agent or construct one locally, then use it to start runs against approved targets or work on vulnerabilities. You can customize an agent before running it and register its configuration for your team to reuse.

Use a pre-built agent

The SDK exports constants for tCell, triage-agent, and remediation-agent. Retrieve one with antigen.agents.get():

import Antigen, {
  tCell,
  triageAgent,
  remediationAgent,
} from "@antigen/sdk";

const antigen = new Antigen(process.env.ANTIGEN_API_KEY);

const agent = await antigen.agents.get(tCell);

Agent	Purpose
`tCell`	Test approved targets and verify fixes
`triageAgent`	Investigate vulnerabilities and determine how remediation should proceed
`remediationAgent`	Prepare pull requests or recommend changes for your team to make

The Antigen team develops these agents with the same SDK available to your team.

Customize an existing agent

Use object composition to keep an agent’s configuration while changing selected fields. Supplying a field replaces its value; combining its existing value with yours adds to it. Skills are instruction strings. This example reads a skill from a Markdown file, changes tCell’s model, and adds the instructions to its configuration:

import { readFile } from "node:fs/promises";

const original = await antigen.agents.get(tCell);
const authentication = await readFile("./skills/our-jwt-scheme.md", "utf8");

const agent = antigen.agent({
  ...original,
  model: "claude-opus-5-cyber",
  skills: [
    ...original.skills,
    authentication,
  ],
});

The configuration includes a base reference that identifies the underlying agent. Keeping that reference preserves tCell’s built-in behavior while you customize its exposed fields. Those fields do not include tCell’s private instructions. The same composition works with other pre-built agents and agents your team has registered. See Models, Skills, and Guardrails for the available configuration.

Construct an agent locally

Call antigen.agent() with your configuration to assemble an agent without starting from a pre-built agent:

const agent = antigen.agent({
  model: "claude-opus-5-cyber",
  skills: ["Check whether a token for one account can access another account's data."],
  guardrails: "Do not test /internal endpoints.",
});

This creates a local Agent object without making an API request. You can use it to start a run without registering it first. See Runs for launching agents and working with their results.

Register an agent

await antigen.agents.register("our-security-agent", agent);

Your team can then retrieve it without defining the configuration again:

const agent = await antigen.agents.get("our-security-agent");

Registered agents also appear in the platform’s assignment dropdown. When your team assigns a vulnerability to one, your webhook handler can retrieve the agent and launch it to investigate or prepare a fix. See Assigning to your own agents for setting up that workflow. Registering a name that already exists returns an error. Use update() to change an existing agent.

Update a registered agent

Pass the fields you want to change:

await antigen.agents.update("our-security-agent", {
  model: "claude-opus-5-cyber",
});

Fields you omit keep their saved values. To append skills, retrieve the agent and include its existing skills in the update:

const agent = await antigen.agents.get("our-security-agent");

await antigen.agents.update("our-security-agent", {
  skills: [...agent.skills, "Our GraphQL API uses cursor-based pagination. Check authorization when following cursors across accounts."],
});

Updating a name that does not exist returns an error.

Using the Asset Map

Agents can query your organization’s Asset Map through a tool available during a run. They can look up assets and explore their relationships to gather infrastructure context as they work. For example, an agent investigating an application can look up its connected resources and use those relationships to decide what to investigate next. You can also query the Asset Map directly from your application using the SDK.

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

Use a pre-built agent

Customize an existing agent

Construct an agent locally

Register an agent

Update a registered agent

Using the Asset Map

​Use a pre-built agent

​Customize an existing agent

​Construct an agent locally

​Register an agent

​Update a registered agent

​Using the Asset Map

Use a pre-built agent

Customize an existing agent

Construct an agent locally

Register an agent

Update a registered agent

Using the Asset Map