Documentation

How VigilCode installs, scans, and ships fixes

VigilCode agents run continuous scans and open PRs against your repositories. This page walks the install flow, what the agents actually do today, and how to get pilot access during the soft launch.

Install flow

Three steps from install to merged fix

  1. 01

    Install the GitHub App

    Approve read on metadata, secrets, and pull requests across the repositories you want monitored. The App installs at the org or repo scope you choose.

  2. 02

    Agents scan continuously

    A worker pool watches every push, PR open, and check_run settle. It re-runs a static analysis pass tuned to the languages in the repo and surfaces findings ranked by severity and confidence.

  3. 03

    PRs land in your inbox

    When an agent finds a fix that beats the confidence threshold, it opens a PR on a fresh branch with a regression test alongside the patch. You review like any other PR — the difference is that the heavy parts are already in.

Inside the agent

What the agents actually run on each scan

Under the hood, a worker combines language-specific static analysis with a structured LLM pass to propose patches. The whole thing runs only on your repos — nothing wild.

Detect → diagnose
Each push / PR open re-runs the language-specific static analyzer (Biome for TS/JS, ruff/flake8 for Python, jdtls for Java). Findings carry a severity, source, and confidence score so the LLM pass sees the same shape an engineer would.
Patch → test
For findings above the confidence threshold, the worker drafts a patch and writes a vitest / pytest / JUnit regression test on the same branch. The PR author in your repo lands as a regular bot commit.
Modernization → refactor
Lower-priority passes migrate deprecated APIs, replace eager patterns with safer equivalents, and scaffold the test files your old code never had. These run on a slower cadence and only open a PR when there is something concrete.
Reports → dashboard
Every scan, finding, and PR surfaces on the public dashboard at /dashboard. Use it as the single source of truth for what the agents have done this week.

Early access

Pilot access opens in waves

We are onboarding pilot teams in small groups so we can tune the confidence thresholds, scan cadence, and PR volume for each codebase shape. The waitlist decides who gets onboarded and in what order.

How to get pilot access

Reserve your spot on the waitlist

Drop your email on the home page. We email you when a pilot slot opens — no commitment until you accept. We onboard ~10 teams a week, prioritized by codebase size and language mix.

Reserve early accessBack to home

What gets installed

Privacy and audit guarantees

01

VigilCode reads source, scan metadata, and existing test results. It does NOT read your GitHub secret store beyond what is needed for the install handshake.

02

Agents run inside our infrastructure, never on your machines. No CI minutes are charged to your account.

03

Nothing leaves the audit trail: every agent action surfaces as a check run and a PR you can diff against.