STAR Plugin (IDE)

STAR Plugin brings Bright's dynamic security testing directly into your AI coding tool. Instead of running in CI as a standalone binary (like STAR), the plugin works interactively inside your IDE. You ask an agent to scan, and it handles the rest.

The plugin ships as a native package for each supported tool, wiring its orchestration agents and skills to the Bright MCP server. You get the same Bright scanning engine, the same vulnerability coverage, but driven conversationally from your editor. It also ships a discovery-only agent for mapping the attack surface when targets are hard to crawl or lack API specs.

STAR Plugin vs. STAR (CI) vs. Bright MCP

How it works

flowchart LR
    subgraph IDE["Your AI Coding Tool"]
        User["You (chat)"] --> Agent["STAR Plugin Agent"]
        Agent --> Skills["Skills<br/>(analyze, auth, register,<br/>scan, fix)"]
    end

    subgraph MCP["Bright MCP Server"]
        Tools["MCP Tools"]
    end

    subgraph Cloud["Bright Cloud"]
        Scanner["Dynamic Security Scanner"]
    end

    Skills --> Tools
    Tools --> Scanner
    Agent -.->|"private/local targets"| Repeater["Bright Repeater<br/>(on your machine)"]
    Repeater ==>|"outbound only"| Scanner

1. You ask the agent to scan your app (local, staging, or any authorized target).
2. The agent analyzes your codebase to discover endpoints and tech stack.
3. It reaches the target, either starting it locally or health-checking a supplied URL.
4. For private/local targets, it spins up a Bright Repeater on your machine.
5. It configures authentication if the app requires login.
6. It registers the attack surface and runs dynamic scans via Bright's engine.
7. (Remediation loop) It fixes findings, gets the fixed code into the running target, and re-runs the same scan to prove the fix.
8. (Discovery) Or, with the discovery agent, it stops after registering the endpoints and reporting what it couldn't register. It builds the endpoint list from the code itself, crawls only to fill gaps, and populates realistic parameter values, without running any scan or changing code.

Supported tools

Every package lives in the public Bright AI plugins repository.

All packages wire the same agents and skills. Only the tool-specific install mechanics differ.

Requirements

• BRIGHT_TOKEN: a Bright API token (personal, project, or org-level)
• BRIGHT_HOSTNAME: your Bright cluster hostname, host only, without https:// (default: app.brightsec.com)
• The AI coding tool installed and configured

📘

Project-scoped tokens are recommended

With a project-scoped BRIGHT_TOKEN, the agents automatically use the only reachable project. With an org-wide token, you'll need to name the project when you start. The agents ask rather than guess.

Next steps

• Agents & Skills: what each agent does and when to use it
• Installation: per-tool install guides
• Devin (Desktop & CLI): install and usage specifics for Devin
• Usage & Examples: common scanning scenarios
• FAQ: credentials, Repeater, scanning, and remediation questions
• Bright AI plugins repository: the source for every package, with a per-tool README