Security review that ends in a merge-ready patch, not another ticket. Follow one pull request from the moment it lands to a verified, evidenced close.
A change touches agent code, an MCP config, a prompt, or a RAG pipeline — plus the spec it claims to implement.
Setright reviews the diff like a senior security colleague: over-scoped tools, prompt-injection surface, RAG permission bleed, secrets and machine identities in code — every finding cited to the line and the rule.
For the finding kinds it covers, Setright generates the complete PR: the fix diff, the tests, the spec check, and the PR body. Nothing is left as a ticket for a human to translate.
The agent owner approves and merges — Setright never merges on its own. The merged state is re-scanned, the closure verified, and the evidence flows to Dossier.
The same review the homepage runs live, walked stage by stage: one finding, its fix, and the verified close.
MCP tool granted write scope it never uses
The crm-lookup server holds crm.records.write and crm.records.delete, but the agent only calls read paths. Reachability analysis confirms no write path is exercised.
The smallest patch that closes the finding
Patch approved — the owner reviewed the patch and merged it at the human gate — the merge is recorded
Identity re-issued — the long-lived key is retired; a scoped 15-minute token is provisioned by Tokynd Namesake
Finding re-verified — re-scan of the merged state: the exposure is closed at the source
Control evidence logged — the SOC 2 CC6.1 / ISO 42001 evidence pack is updated automatically
Per pull request