1. Connect a repository
Sign in to the web console and open Connections. Install the Console GitHub App for your organization, granting access to at least one repository you’re comfortable experimenting on. The repositories you grant appear under Projects. That’s your context — the code agents can read.2. Ask an agent something
Open Console in the sidebar and start a new chat. Ask a question about the repository you just connected:Look at this repository and tell me where user input reaches a database query without parameterization.Watch what happens. The agent clones the repository, reads files, searches, and traces call paths — and you see each tool call as it runs. This is the difference between an agent and a scanner: it’s deciding what to look at next based on what it just found. Try following up. Is that actually reachable from an HTTP handler? The agent investigates rather than re-answering from memory. If it confirms something, it records a finding — durable, with its reasoning attached.
3. Write an agent
The built-in library covers a lot, but the harness is most useful when the agents are yours. Open Agents and create one:4. Automate it
Open Workflows and click New workflow.
Click Save.
The description isn’t decoration — Console’s orchestrator reads it as the goal and briefs your agent against
it. Write it as an instruction, not a label. See create a workflow.
5. Run it
Click Run workflow, select your repository, and leave the git ref empty to use the default branch. Console provisions a sandbox, clones the repository, and runs your agent. Click View runs to watch the chain: each step shows status and duration as it completes, and the run page lists findings and output deliveries when it’s done. Your pull request trigger is live too — open a pull request in that repository and the workflow fires on its own, against the pull request’s head.The Comment on triggering pull request output only acts on pull-request runs, so it’s skipped on the
manual run you just did. Open a pull request to see it deliver.
What you just built
- Context — a connected repository agents can read
- Harness — your own agent, defined in YAML frontmatter and Markdown
- Workflow — that agent running automatically on every pull request, reporting to your team
Where to go next
The Harness
Skills, detections, and the full tool surface.
Triage an existing backlog
Connect a scanner and find what’s actually reachable.
Gate merges on review
Block merging until security review passes.
Install the CLI
Run the same agents on local, uncommitted code.
