STAR Plugin (IDE)
Bright DAST agents and skills for AI coding tools — Cursor, Claude Code, Codex, GitHub Copilot, and Antigravity CLI
STAR Plugin brings Bright's dynamic security testing directly into your AI coding tool. Instead of running in CI as a standalone binary (like STAR), the plugin works interactively inside your IDE — you ask an agent to scan, and it handles the rest.
The plugin ships as a native package for each supported tool, wiring its orchestration agents and skills to the Bright MCP server. You get the same Bright scanning engine, the same vulnerability coverage, but driven conversationally from your editor.
STAR Plugin vs. STAR (CI) vs. Bright MCP
| STAR (CI) | STAR Plugin (IDE) | Bright MCP (raw) | |
|---|---|---|---|
| Where it runs | Your CI/CD runner | Your IDE / AI coding tool | Any MCP-capable client |
| How you use it | Triggered by PR/push/schedule | Ask an agent in chat | Call MCP tools directly |
| Automation level | Fully autonomous (scan → fix → PR) | Agent-guided, interactive | Manual — you orchestrate |
| Fixes code | Yes, commits to branch | Yes (remediation-loop agent) | No — tools only |
| Setup | Env vars in CI | Plugin install + env vars | MCP server config |
| Best for | Continuous pipeline security | Dev-time security from the editor | Custom integrations |
How it works
flowchart LR
subgraph IDE["Your AI Coding Tool"]
User["You (chat)"] --> Agent["STAR Plugin Agent"]
Agent --> Skills["Skills<br/>(analyze, auth, register,<br/>scan, fix)"]
end
subgraph MCP["Bright MCP Server"]
Tools["MCP Tools<br/>(runScan, runDiscovery,<br/>createRepeater, …)"]
end
subgraph Cloud["Bright Cloud"]
Scanner["Dynamic Security Scanner"]
end
Skills --> Tools
Tools --> Scanner
Agent -.->|"private/local targets"| Repeater["Bright Repeater<br/>(on your machine)"]
Repeater ==>|"outbound only"| Scanner
- You ask the agent to scan your app (local, staging, or any authorized target).
- The agent analyzes your codebase to discover endpoints and tech stack.
- It reaches the target — starting it locally or health-checking a supplied URL.
- For private/local targets, it spins up a Bright Repeater on your machine.
- It configures authentication if the app requires login.
- It registers the attack surface and runs dynamic scans via Bright's engine.
- (Remediation loop) It fixes findings, restarts the app, and re-scans to prove the fix.
Supported tools
| Tool | Package |
|---|---|
| Cursor | cursor/ |
| Claude Code | claude-code/ |
| Codex | codex/ |
| GitHub Copilot | github-copilot/ |
| Antigravity CLI | antigravity/ |
| Devin | claude-code/ — Devin reads Claude plugin manifests, so no separate package is needed. See Devin (Desktop & CLI). |
All packages wire the same agents and skills — only the tool-specific install mechanics differ.
Requirements
BRIGHT_TOKEN— a Bright API token (personal, project, or org-level)BRIGHT_HOSTNAME— your Bright cluster hostname (default:app.brightsec.com)- The AI coding tool installed and configured
Project-scoped tokens are recommendedWith a project-scoped
BRIGHT_TOKEN, the agents automatically use the only reachable project. With an org-wide token, you'll need to name the project when you start — the agents ask rather than guess.
Next steps
- Agents & Skills — what each agent does and when to use it
- Installation — per-tool install guides
- Devin (Desktop & CLI) — install and usage specifics for Devin
- Usage & Examples — common scanning scenarios
Updated about 2 hours ago