Corridor

No entries match these filters. Clear filters

1. docs update Oct 10, 2026 · issue 100

   Corridor adds Agent Steering MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool that injects project-specific security guidance into AI coding assistants before code generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2. docs update Oct 10, 2026 · issue 100

   Corridor adds a Guardrail Maintenance scheduled agent that writes and updates guardrails and builds a Repository Threat Model context item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a Guardrail Maintenance scheduled agent that writes and updates guardrails, adds coverage for new product surface, and retires true duplicates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Repository Threat Model context item written by the Guardrail Maintenance agent, used by Corridor Agent Steering and pull request review to steer coding agents toward more secure code.

   2 details in Everything

3. docs update Oct 10, 2026 · issue 100

   Corridor adds Agent Steering to guide AI coding agents like Claude Code and Cursor with project-specific security guardrails before code is written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Have your AI coding agent consult project security guardrails before implementing a new authentication flow, so it writes to your team's standards from the start.
   copy

   $ {
     "tool": "analyzePlan",
     "parameters": {
       "plan": "Implement OAuth2 authorization code flow with PKCE for the user login endpoint, using the existing /auth routes in src/auth/",
       "cwd": "/home/user/myproject",
       "branch": "feature/oauth-login",
       "commit_hash": "a3f9c12",
       "has_unstaged_changes": true
     }
   }

   • Adds the analyzePlan tool via the Corridor MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, which AI coding agents call before generating code — accepting plan, cwd, branch, commit_hash, and has_unstaged_changes parameters to return project-specific security context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Claude Code, Cursor, and other MCP-compatible AI coding agents as targets for pre-generation security steering.
   • Delivers relevant guardrails and context documents to the agent at plan time, so security guidance is applied before code is written rather than flagged afterward.

   3 details in Everything

4. docs update Sep 25, 2026 · issue 085
   └──▷ USE IT
   Embed Corridor's pre-commit security scan into a Devin environment so every commit the agent makes is blocked if it contains security findings.
   yaml copy

   initialize:
     - name: Install Corridor CLI + pre-commit security scan
       run: |
         curl -fsSL https://app.corridor.dev/cli/devin-setup.sh | sh

   After rotating the CORRIDOR_API_KEY secret in Devin, revoke the old key from the Corridor dashboard to close off the previous credential.
   📍In the Corridor dashboard, go to Governance › Long-Running Agents › Configuration tab › Team-Owned API Keys. Locate the old key by name and creation date, then click Revoke.
5. docs update Sep 25, 2026 · issue 085
   └──▷ HOW TO FIND IT
   Wire up a Codex cloud environment so every agent session automatically scans staged changes and blocks commits with security findings — no manual CLI install needed.
   📍In the Corridor dashboard, go to Governance › Long-Running Agents › Configuration tab. Select Codex, generate an API key, then in your Codex environment settings at chatgpt.com/codex/cloud/settings/environments add a secret named CORRIDOR_API_KEY with the copied value. Paste the following into the environment's Setup script field and save.
   Bootstrap the Corridor CLI and pre-commit hook in a Codex cloud session — runs automatically at session start when added to the environment setup script.
   copy

   $ curl -fsSL https://app.corridor.dev/cli/codex-setup.sh | sh

6. docs update Sep 25, 2026 · issue 085

   Corridor: Introduces a Setup script field in Claude cloud environment settings (at claude.ai/admin-settings/cloud-environments) where pasting curl -fsSL https://app.corridor.dev/cli/claude-setup.sh | CORRIDOR_API_KEY=YOUR_KEY sh installs the Corridor CLI and pre-commit hook for every session.

   └──▷ TRY IT
   Install the Corridor CLI and pre-commit hook into a Claude Code cloud environment so every agentic session scans staged changes before committing.
   copy

   $ curl -fsSL https://app.corridor.dev/cli/claude-setup.sh | CORRIDOR_API_KEY=YOUR_KEY sh

   After configuring the hook, navigate to the Findings view to review security issues caught by agentic sessions before they were committed.
   📍In the Corridor dashboard, go to Governance › Long-Running Agents, then click the Usage tab to review findings by severity, affected file, and resolution status.
   • Exposes a CORRIDOR_API_KEY environment variable used by the setup script to authenticate the CLI against a Corridor team.

   1 detail in Everything

7. docs update Sep 25, 2026 · issue 085

   Corridor: Adds CORRIDOR_API_KEY secret (with Permission set to Team) as the authentication mechanism for connecting Corridor to Cursor Cloud Agent environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Install the Corridor CLI into a custom agent environment or Docker image so every session scans commits without relying on the managed Start script.
   copy

   $ curl -fsSL https://app.corridor.dev/cli/install.sh | CI=true sh

   Wire up the git pre-commit hook manually in a repo that uses Husky so Corridor blocks any commit containing security findings.
   copy

   $ corridor scan --staged

   Navigate the Corridor dashboard to generate an API key and copy the setup script for your Cursor Cloud Agent environment.
   📍In the Corridor dashboard, go to Governance › Long-Running Agents › Configuration tab. Select Cursor, enter a key name (e.g. Cursor cloud agents), click Generate key, copy the displayed key, then paste the setup script from step 3 into the Start script field in your Cursor environment settings.
   • Adds corridor scan --staged as the pre-commit hook command that scans staged changes and blocks commits containing security findings.
   • Installs the Corridor CLI via https://app.corridor.dev/cli/install.sh into each Cursor Cloud Agent session through the Start script field.
   • Supports manual installation into custom Docker-based agent environments by placing the Corridor CLI binary on PATH and adding a pre-commit hook at .git/hooks/pre-commit or .husky/pre-commit.

   3 details in Everything

8. docs update Sep 24, 2026 · issue 084

   Corridor adds a beta GET /teams/:id/findings/sarif endpoint that exports findings as SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. for ingestion by tools like Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds GET /teams/:id/findings/sarif endpoint (beta) that returns findings as a SARIF 2.1.0 document (application/sarif+json), consumable by any SARIF-compatible tool such as Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Maps finding severity to SARIF level (error for critical/high, warning for medium, note for low) and properties.security-severity (9.0, 7.0, 5.0, or 3.0) for downstream SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. tooling compatibility.
   • Encodes Corridor finding IDs in partialFingerprints.corridorFindingId/v1 and deep-links to findings via hostedViewerUri inside each SARIF result.
   • Groups results into one SARIF run per project and branch via automationDetails.id (corridor/findings/<projectId>/<branch>/), with ~no-branch substituted when the branch is unknown.

   4 details in Everything

9. docs update Sep 24, 2026 · issue 084

   Corridor adds a Devin cloud-agent integration that installs a git pre-commit hook to block commits with security findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Provision a Devin environment with the Corridor CLI and pre-commit security hook so every commit Devin makes is scanned before it lands.
   yaml copy

   initialize:
     - name: Install Corridor CLI + pre-commit security scan
       run: |
         curl -fsSL https://app.corridor.dev/cli/devin-setup.sh | sh

   Add the Corridor API key as a Devin organization secret before saving the environment config, so the snapshot build can authenticate.
   📍In Devin settings, go to app.devin.ai/settings › Organization tab › Secrets, and add: Name: CORRIDOR_API_KEY Value: <the key displayed once in the Corridor Configuration tab modal>
   Review security findings that the Devin pre-commit hook caught, including severity and affected files, without leaving Corridor.
   📍In the Corridor dashboard, go to Governance › Long-Running Agents and open the Usage tab to see findings with severity, affected files, and resolution status.
   • Adds a CORRIDOR_API_KEY organization secret in Devin that the Corridor CLI uses to authenticate during environment setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Governance > Long-Running Agents configuration page in the Corridor dashboard with a Configuration tab for selecting Devin as an agent and generating API keys.
   • Adds a curl -fsSL https://app.corridor.dev/cli/devin-setup.sh | sh setup snippet for the Devin initialize environment block that installs the Corridor CLI and a git pre-commit hook.
   • Supports viewing and revoking team API keys under Team-Owned API Keys in the Corridor Configuration tab, showing each key's name, creation date, and last-used date.
   • Findings caught by the pre-commit hook appear in the Usage tab of the Long-Running Agents page with severity, affected files, and resolution status.

   +1 more show less

   • Integrates with Devin to scan staged changes and block commits containing security findings via a git pre-commit hook installed once in the home directory, covering all repositories cloned after setup.

   6 details in Everything

10. docs update Sep 24, 2026 · issue 084

    Corridor: Adds CORRIDOR_API_KEY secret support in Codex cloud environments to authenticate the Corridor CLI during cloud sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Bootstrap a Codex cloud environment to auto-install the Corridor CLI and pre-commit security hook on every session start.
    copy

    $ curl -fsSL https://app.corridor.dev/cli/codex-setup.sh | sh

    Enable Codex cloud agent scanning by wiring the Corridor API key into your environment before the setup script runs.
    📍Name: CORRIDOR_API_KEY Value: <your-corridor-api-key>
    • Adds a Codex integration option under Governance > Long-Running Agents > Configuration in the Corridor dashboard, enabling per-session pre-commit scanning of staged changes.
    • Supports API key management (view, revoke, rotate) under Team-Owned API Keys in the Configuration tab.

    2 details in Everything

11. docs update Sep 24, 2026 · issue 084

    Corridor: Runs corridor scan --staged as a git pre-commit hook in Claude Code cloud sessions, blocking commits that contain security findings before code is committed.

    └──▷ TRY IT
    Bootstrap Corridor security scanning in a Claude cloud environment so every AI-driven session auto-installs the pre-commit hook and blocks vulnerable commits.
    copy

    $ curl -fsSL https://app.corridor.dev/cli/claude-setup.sh | CORRIDOR_API_KEY=YOUR_KEY sh

    Set the Corridor-enabled cloud environment as the default for Claude Code sessions org-wide so all agents run under the security policy.
    📍1. In the Corridor dashboard, go to Governance › Long-Running Agents › Configuration tab and select Claude Code. 2. Generate an API key named (e.g. Claude cloud agents) and copy the finished setup command. 3. Go to claude.ai/admin-settings/cloud-environments, select (or create) your environment, set Network access to Full access, paste the setup command into the Setup script field, and save. 4. Go to claude.ai/admin-settings/claude-code and set this environment as the organization default.
    • Integrates with Claude Tag (Anthropic's @Claude in Slack) cloud environments in addition to Claude Code web sessions, configurable via claude.ai/admin-settings/claude-tag under Slack > Advanced > default environment.

    1 detail in Everything

12. docs update Sep 24, 2026 · issue 084

    Corridor: Exposes a one-time API key from the Long-Running Agents modal to authenticate agent sessions with Corridor.

    └──▷ HOW TO FIND IT
    Review security findings caught by agent sessions before they reach your codebase.
    📍In the Corridor console, go to Governance › Long-Running Agents and open the findings tab to inspect severity, affected files, and resolution status for each agent session.
13. docs update Sep 24, 2026 · issue 084

    Corridor adds integrations for Claude Code/Claude Tag, Codex, and Devin cloud agents to scan code before every commit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds integration with Claude Code and Claude Tag cloud environments to scan code for security vulnerabilities before every commit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds integration with Codex cloud to scan code for security vulnerabilities before every commit.
    • Adds integration with Devin to scan code for security vulnerabilities before every commit.

    3 details in Everything

14. docs update Sep 23, 2026 · issue 083

    Corridor adds Context: attach named notes or documents to projects so guardrails analyze code against your own internal standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Context, a named note or uploaded document attached to a project that supplies guardrails with organization-specific background — internal libraries, approved patterns, coding standards, and policy excerpts — to make PR review analysis more relevant and reduce false positives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Context applies to PR Reviews (used when Corridor reviews pull requests) and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Plan (supplied to AI coding agents so generated code fits your standards).

    2 details in Everything