Review Agents

Why It Matters

A review agent lets an AI client you already use look at every new or changed report on a schedule and leave a short, staff-only triage brief on it. You don’t have to give that client the whole Security module to do it.

The agent runs on your side: in ChatGPT, in Claude, or in a script or API runner you schedule. Kit doesn’t run it for you. Kit gives it one narrow endpoint and four tools:

Tool	What it does
csirt_review_get_project	Your reviewer guide, program context, scope and areas, and how much of today’s budget is left
csirt_review_next	The next report due for review, with a 30-minute lease
csirt_review_get_report	The same report again, if the agent lost its context
csirt_review_submit	Files one brief against the lease

The agent can’t change status, severity, assignment, dismissal, bounties or karma. It can’t message researchers. It never sees researcher names, emails, karma, location, payouts, attachments, or internal notes you haven’t shared with it.

What a Brief Contains

• Recommendation: suggests validating, needs more information, suggests dismissing, or unsure
• Summary: what the report claims and what the agent concluded
• Scope: in scope, out of scope or unclear, with the exact line of your scope or context it relied on. A verdict that doesn’t quote your own words is shown as unclear.
• Suggested severity and CVSS vector
• Suggested area and a possible duplicate from similar reports
• Up to three questions you could ask the researcher

The brief appears on the report’s Details tab as AI suggestion · agent name. When a brief exists, AI screening becomes the card’s Report quality row. A brief is advice: nothing changes until someone on your team acts with the usual buttons. A badge marks a brief written before the report last changed.

Filing a brief doesn’t count as team activity: it doesn’t reset stall nudges, send emails or Slack posts, or fire webhooks. Researchers never see briefs.

Before You Start

• You need to be a Security admin (account admins always are).
• Add reviewer context so the agent knows your product: open Program settings → General and fill in Reviewer context (tech stack, auth model, environments, accepted risks, behaviour that is by design). Each area can carry its own reviewer context too. This text is staff-only and never published to researchers, but it is sent to every agent you connect, so don’t paste secrets.

Create an Agent

1. Open Integrations → Review agents and click New review agent.
2. Name it and set the expected run interval: how often your platform will run it. Kit warns you if reports are waiting and the agent has gone quiet for twice that long plus an hour.
3. Read the Sent to the agent and Stays in Kit lists, then click Create agent and share reports.

You become the agent’s owner. If the owner leaves the account or stops being a Security admin, the agent pauses and the Security admins are told; any of them can take it over from the edit form.

An account can have up to five agents. Agents are free on paid plans and don’t take a seat.

Connect ChatGPT or Claude

ChatGPT, claude.ai and Claude Code scheduled tasks connect with OAuth.

1. On the agent’s page, click Connect a platform. For the next 15 minutes, a connection you approve links to this agent.
2. In ChatGPT or Claude, add a custom connector with the agent endpoint shown on the agent’s page (https://startupkit.app/mcp/csirt_review/v1).
3. Approve the Connect a review agent screen in Kit. It names the agent, the client and where it sends you back.

Kit only links agents to ChatGPT, Claude or a local client. Every new connection is announced to your Security and account admins. Disconnecting from the agent’s page stops it at once.

Set the connector to run without asking for approval on each tool call: a scheduled run has nobody to click Allow. If your platform waits for an approval, the agent’s page shows reports that were taken but never got a brief.

Use a Key (API Runners and Scripts)

For the xAI API, OpenAI’s Responses API, Claude Managed Agents or your own cron job:

1. On the agent’s page, under Keys, click Create key. Keys last up to 90 days.
2. Copy the key. It starts with kit_agent_ and is shown once.
3. Send it as a header to the agent endpoint: Authorization: Bearer kit_agent_….

An agent can have two live keys, so you can create the next one before the current one expires. Kit reminds the owner 7 days and 1 day before a key expires. If your account limits API access by IP, calls from AI vendors’ servers are refused unless their addresses are allowed.

What the Agent Reads

A report is due for an agent when it is Submitted, Triaged or Needs clarification, it changed after the agent was created, and it has been quiet for 10 minutes (or an hour has passed since the agent’s last brief on it). Restricted and sample reports are never served.

For each report the agent receives the title, description, reproduction steps, endpoint and severity claims; the last 10 messages with the researcher (staff shown as “staff”); the assessed severity; the area and its reviewer context; Kit’s AI screening and prompt-injection verdicts; and similar reports (open ones by id only).

Fields the researcher wrote are marked as untrusted. If Kit’s prompt-injection scan flags a report, the agent can’t recommend dismissing it.

Sharing an Internal Note

Internal notes stay in Kit unless you share them one at a time. On a note you wrote, click the chip icon to share it with agents. A note that looks like it contains a credential (an AWS key, a GitHub or Slack token, a JWT, a private key) can’t be shared. The note author or any Security admin can stop sharing; agents that already read the note keep their copy.

Limits

Limit	Value
Reports taken per agent per day	150
Briefs per agent per day	100
Tool calls per agent per day	2,000
Tool calls per agent per minute	60
Tool calls per account per minute, all agents	120
Briefs per report per agent per day	4

The endpoint also limits HTTP requests to 120 per bearer per minute and 600 per source IP per minute, with 30 per minute when no bearer is supplied. Connections using the same vendor egress address share the IP ceiling, so combined traffic can receive HTTP 429 even when each agent has capacity.

A report taken three times at the same version without a brief stops being served until it changes; the agent’s page lists it under Served three times, never briefed.

Extra Powers

Two toggles on the agent’s form let it do slightly more. Both are off by default and act as soon as you turn them on:

• Suggest the area: fills the suggested area on reports that have none. Staff still confirm it.
• Flag duplicates: sorts a report to the bottom of the list when the agent names an older, validated original and Kit’s own similarity check agrees. Never on a report with a high or critical severity signal, or one flagged for prompt injection. It never hides a report or touches its SLA, and the flag clears when the report changes.

The agent’s page shows how often staff ended up agreeing with each.

Data and Privacy

An agent you connect is your own client reading your data with a credential you created. Report details go to the AI vendor you chose, under your contract with them. Use a business or API plan that doesn’t train on your inputs; the vendor’s plan decides where data is processed. Kit can’t recall what an agent has already read.

Every call is logged on the agent’s page (tool, report, outcome, credential and IP, never the content) and kept for 90 days.

Next Steps

• AI Integration: the in-app Security Agent and MCP tools for your team
• AI-Native VDP Triage: triaging interactively with Claude
• Prompt-Injection Scan: how Kit marks text aimed at AI tools