AI agents · Green Agent · Remediation

Green Agent.
Writes the fix.

For every finding, Green Agent drafts the change in your code, in your style, and explains why it works. Your developers review it like any other diff.

Scan your appBook a demo
object Vault { fun seal(data: ByteArray): ByteArray { val c = Cipher.getInstance( "AES/ECB/PKCS5Padding") c.init(ENCRYPT_MODE, key) return c.doFinal(data) } } "AES/GCM/NoPadding" Same input, same output. ECB leaks the pattern. FIX · VAULT.KT READY FOR REVIEW - AES/ECB/PKCS5Padding + AES/GCM/NoPadding, fresh IV

What it does

A pull request's worth
of care, per finding.

  • Writes

    The change, not a guideline

    A concrete patch in Swift, Objective-C, Kotlin, Java, Dart for Flutter, or JavaScript and TypeScript for React Native. No links to a wiki page.

  • Matches

    Your code, your conventions

    Uses your helpers, naming, and patterns, so the fix reads like your team wrote it.

  • Explains

    Why the fix holds

    What was wrong, what changed, and what to watch for, in a few plain sentences.

  • Restrains

    The smallest change that works

    No drive-by refactors. A diff you can review in minutes.

  • Covers

    Code, config, and dependencies

    Source edits for SAST, behavior fixes for DAST, and version pins for SCA.

  • Defers

    The call is yours

    Nothing merges without a person approving it.

Example fix

Encryption that only looked encrypted.

HighSAST · fixed by Green AgentMASVS-CRYPTO-1 · CWE-327data/Vault.kt

AES in ECB mode protects the vault

Green Agent's note

ECB encrypts identical blocks to identical output, so patterns in the data survive. GCM uses a fresh IV for every message and authenticates the result, so tampering is caught too. open() now reads the 12-byte IV from the front of the ciphertext.

Before
fun seal(data: ByteArray): ByteArray {
  val c = Cipher.getInstance("AES/ECB/PKCS5Padding")
  c.init(Cipher.ENCRYPT_MODE, key)
  return c.doFinal(data)
}

Same input, same output.

Green Agent's fix
fun seal(data: ByteArray): ByteArray {
  val c = Cipher.getInstance("AES/GCM/NoPadding")
  c.init(Cipher.ENCRYPT_MODE, key)
  return c.iv + c.doFinal(data)
}

A new IV every time.

Approve fix Request changes 1 file · seal() and open()

Where Green Agent fits

  1. 01ConnectUpload a build or link CI
  2. 02ReadSAST, DAST, and SCA
  3. 03TriageFalse positives out, ranked
  4. 04 · Early accessAttack pathsRed Agent chains findings
  5. 05 · This pageFixGreen Agent writes it
  6. 06 · EnterpriseReviewPeople sign off

Fair questions.

How do fixes reach our code?

Both. Connect GitHub, GitLab, or Bitbucket and Green Agent opens a pull request for each fix, with an explanation and tests where possible. Prefer not to connect a repo? Download the fix as a patch file. Nothing merges without your approval.

What if a fix is wrong?

You review it like any other change, and nothing merges without a person approving it. On Enterprise, a Nandee security engineer checks it first.

Why "Green"?

Red Agent breaks things. Green Agent mends them. The names are colors; the pen stays red.

Less reading about fixes. More merging them.

Scan your app