Docs
The swarm
Depths, what a run costs, and what comes back.
What a run does
A swarm run reviews one commit of a repository with a team of AI specialists. Every claim they make goes to a verifier whose only job is to disprove it. What survives comes back with its evidence, a patch, and the attack paths it forms with other findings.
It needs a completed scan of the repository and an organization that can use AI: a paid plan, or trial credits. Members and above start runs from the Swarm page or from a repository.
Depth
| Depth | What it covers |
|---|---|
| Quick | The most exposed entry points, in one short pass. |
| Standard | Every specialist the threat model calls for. |
| Deep | A second wave that follows leads and chains findings. |
What a run costs
Starting a run reserves its credit ceiling, which grows with the depth and the repository's size and never exceeds your organization's per-run cap. A run usually spends about 60 percent of it; what it doesn't spend goes back when the run ends. Before you start, the launch dialog shows the estimated cost, the reservation and your balance.
If the budget runs out while the specialists are still hunting, the run still verifies and delivers what they found, and ends as Budget exhausted. You can cancel a run at any time: agents stop at their next step and the run is charged only for what it used.
A run, phase by phase
| Phase | What happens |
|---|---|
| Recon | Maps the repository: languages, entry points, authentication, data stores, outbound calls, AI and agent code, CI and infrastructure. The scan's findings become leads. |
| Plan | Writes a threat model and decides which specialists hunt where. Every entry point gets an access-control and an injection review. |
| Hunt | Specialists work in parallel. On Deep, a review of their results can send a second wave. |
| Verify | A verifier, starting fresh, tries to disprove each claim: confirmed, rejected or uncertain. |
| Synthesize | Joins confirmed findings into attack paths and writes the summary, risk score and coverage. |
While it runs, the run's page shows the phase, each agent and the steps it has used, a one-line feed of what the agents are doing, and the credits spent so far.
The specialists
- Access control
- Injection
- Web client
- Server-side requests and files
- Crypto and secrets
- Business logic and concurrency
- Data exposure and privacy
- Supply chain and CI
- Dependency reachability
- Cloud and infrastructure
- LLM application security
- Agentic and MCP security
- AI supply chain and repository injection
What comes back
- Confirmed findings, in your findings list with the source Swarm. Each shows the specialist's evidence step by step, from source to sink, and the verifier's reasons.
- Attack paths of two to five confirmed findings, with what an attacker needs and what they get.
- A risk score from 0 to 100 with its rationale, and a short summary.
- Coverage: what was reviewed, what was skipped, and why.
- Uncertain claims the verifier could neither confirm nor reject, kept on the run for you to review.
Export report downloads the run as a Markdown document.
How the swarm treats your code
Agents only read the snapshot. They have no network, can't run code and can't write anywhere. Your code reaches the models marked as untrusted content, never as instructions, and a claim is accepted only if it quotes your code exactly and its patch applies. Text in the repository aimed at AI agents, and hidden Unicode, go to the AI supply chain specialist as leads.