Documentation Index
Fetch the complete documentation index at: https://docs.ghostsecurity.ai/llms.txt
Use this file to discover all available pages before exploring further.
Agents are specialized security analyzers within the Ghost Exorcist engine. Each agent focuses on a category of vulnerabilities (authentication, injection, XSS, and so on) and evaluates your code against a set of defined criteria.
How agents work
Detection is organized in a three-level hierarchy:
| Level | Description | Example |
|---|
| Agent | A category-level analyzer focused on a class of vulnerabilities | Authentication |
| Vector | A specific vulnerability pattern within an agent | Missing Authentication, Broken Authentication |
| Criteria | The individual checks a vector evaluates against your code | ”Verify that all API endpoints require authentication tokens” |
Why criteria?
Criteria are natural language rules that both humans and agents read and follow. You can look at a vector’s criteria and immediately understand what it checks for, without interpreting code or complex rule syntax. It’s a shared language between you and the detection engine.
Each criterion is a statement of inclusion: it defines a condition or behavior that must be present for a match. If the condition isn’t there, the criterion isn’t met and the finding won’t be produced.
System criteria are intentionally language, framework, and environment agnostic. They provide a baseline that works across any codebase. When you need something more specific, you can create custom vectors with criteria tailored to your language, framework, or environment.
Purpose
Agents and vectors are organized by purpose to match the type of code being analyzed. When you add a project to a repository, you assign it a purpose that determines which agents and vectors apply.
| Purpose | Description |
|---|
| Backend | Server-side and API code: injection, authentication, authorization, data exposure, and more |
| Frontend | Client-side code: XSS, client-side authorization bypass, insecure token storage, and more |
| Mobile | Mobile application code: insecure data storage, certificate pinning, deep link handling, and more |
Viewing agents
Navigate to Agents to browse all agents, vectors, and their criteria. You can search by name, filter by purpose or agent type, and expand any agent to see its vectors.
System vs. custom vectors
| System vectors | Custom vectors |
|---|
| Source | Maintained by Ghost | Created by your organization |
| Editable | Read-only | Managers can add, edit, and delete |
| Scope | All projects | Global (all projects) or per-project |
| Purpose | Default detection baseline | Override criteria to match your standards |
Re-validation
After tuning agent criteria, you can re-validate existing findings against the updated criteria without waiting for the next scan. Ghost detects which findings have changed criteria, re-evaluates them against the current code, and updates their status accordingly. Findings that no longer meet the new criteria are closed, and recently closed findings that now meet the criteria are reopened.
See the
Tuning guide for a step-by-step walkthrough of customizing detection and managing findings.
