From e8fec43d4167a896fbdc860da6b94fbcd6a175a8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 1 Jun 2026 13:40:36 +0000 Subject: [PATCH 1/5] docs(readme): expand local dev section with MCP overrides --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 2a85623..6233240 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,24 @@ copilot --plugin-dir /path/to/bright-plugin \ -i "Run a full Bright scan against this application" ``` +#### Overriding the MCP servers locally + +The agent ships two MCP servers in the `mcp-servers` frontmatter of `agents/main.agent.md`: the hosted +`bright` HTTP server and the `cli` stdio server (`@brightsec/cli`). Both default to OIDC. During local +development you can override either entry with `--additional-mcp-config` without editing the agent file, +for example to point at a different Bright environment or to swap OIDC for an API key: + +```bash +copilot --plugin-dir /path/to/bright-plugin \ + --agent bright-security:main \ + --additional-mcp-config '{"mcpServers":{"bright":{"type":"http","url":"https://cloud.brightsec.com/mcp","headers":{"Authorization":"Api-Key YOUR_KEY"}}}}' \ + -i "Run a full Bright scan against this application" +``` + +Keys under `mcpServers` are merged by name, so the `bright` (or `cli`) object you supply replaces the +shipped definition for that server while leaving the others untouched. See [Authentication](#authentication) +for the override that swaps OIDC for an API key. + You can steer the mode and scope with the prompt, for example: - `Run in function mode and scan the selected backend functions through a harness.` From 3f34a8be1a5369e3d0dac93157554728f63cef50 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 1 Jun 2026 13:48:36 +0000 Subject: [PATCH 2/5] docs(readme): note both MCP servers use OIDC in Authentication --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6233240..f542faf 100644 --- a/README.md +++ b/README.md @@ -100,7 +100,7 @@ The agent frontmatter is the source of truth for the shipped Bright MCP configur ## Authentication -MCP access is configured under the `bright` server in the `mcp-servers` frontmatter block of `agents/main.agent.md` and uses OIDC workload identity federation: +MCP access is configured under the `bright` and `cli` servers in the `mcp-servers` frontmatter block of `agents/main.agent.md` and uses OIDC workload identity federation: - MCP URL: `https://cloud.brightsec.com/mcp` - OIDC audience: `https://brightsec.com/agents/github` From 41fa0010a8f8f0c2dafeb2cf7aca9cd05ac3ac45 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 1 Jun 2026 14:00:27 +0000 Subject: [PATCH 3/5] docs(readme): remove redundant MCP override subsection, fold into Authentication --- README.md | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/README.md b/README.md index f542faf..c5720be 100644 --- a/README.md +++ b/README.md @@ -64,24 +64,6 @@ copilot --plugin-dir /path/to/bright-plugin \ -i "Run a full Bright scan against this application" ``` -#### Overriding the MCP servers locally - -The agent ships two MCP servers in the `mcp-servers` frontmatter of `agents/main.agent.md`: the hosted -`bright` HTTP server and the `cli` stdio server (`@brightsec/cli`). Both default to OIDC. During local -development you can override either entry with `--additional-mcp-config` without editing the agent file, -for example to point at a different Bright environment or to swap OIDC for an API key: - -```bash -copilot --plugin-dir /path/to/bright-plugin \ - --agent bright-security:main \ - --additional-mcp-config '{"mcpServers":{"bright":{"type":"http","url":"https://cloud.brightsec.com/mcp","headers":{"Authorization":"Api-Key YOUR_KEY"}}}}' \ - -i "Run a full Bright scan against this application" -``` - -Keys under `mcpServers` are merged by name, so the `bright` (or `cli`) object you supply replaces the -shipped definition for that server while leaving the others untouched. See [Authentication](#authentication) -for the override that swaps OIDC for an API key. - You can steer the mode and scope with the prompt, for example: - `Run in function mode and scan the selected backend functions through a harness.` @@ -109,7 +91,7 @@ MCP access is configured under the `bright` and `cli` servers in the `mcp-server The agent uses MCP only for Bright-side operations. If a required Bright capability is missing from MCP, the run should stop and report that limitation instead of falling back to REST. -If you need to override MCP auth locally with an API key, target the same `bright` server entry: +If you need to override MCP auth locally with an API key, target the same `bright` server entry. Keys under `mcpServers` are merged by name, so the object you supply replaces the shipped definition for that server while leaving the others untouched: ```bash copilot --agent bright-security:main \ From b8e17adae83756e121200575be23e0dba69e3a4e Mon Sep 17 00:00:00 2001 From: Artem Derevnjuk Date: Mon, 1 Jun 2026 18:10:01 +0400 Subject: [PATCH 4/5] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c5720be..a8771a4 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ The agent frontmatter is the source of truth for the shipped Bright MCP configur ## Authentication -MCP access is configured under the `bright` and `cli` servers in the `mcp-servers` frontmatter block of `agents/main.agent.md` and uses OIDC workload identity federation: +MCP access is configured under the `bright` server in the `mcp-servers` frontmatter block of `agents/main.agent.md` and uses OIDC workload identity federation. A secondary `cli` server entry is also provided in the same block: - MCP URL: `https://cloud.brightsec.com/mcp` - OIDC audience: `https://brightsec.com/agents/github` From 41c79236c116954749b40ed8c62ba27b658485dc Mon Sep 17 00:00:00 2001 From: Artem Derevnjuk Date: Mon, 1 Jun 2026 18:13:35 +0400 Subject: [PATCH 5/5] docs: update formatting in README and main.agent.md for clarity --- README.md | 2 +- agents/main.agent.md | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index a8771a4..8ab6a64 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ The plugin ships Bright MCP/OIDC configuration in the frontmatter of `agents/mai ## How It Works -``` +```text Resolve Scope -> MCP Check -> Analyze Target -> Start App or Harness -> Setup + Scan Prep -> Auth -> Repeater + Entrypoints -> Scan -> [Fix -> Validate] x 5 ``` diff --git a/agents/main.agent.md b/agents/main.agent.md index bca9f36..2a60fb9 100644 --- a/agents/main.agent.md +++ b/agents/main.agent.md @@ -28,6 +28,8 @@ mcp-servers: revoke: 'https://cloud.brightsec.com/api/v1/revoke' --- +# Bright Agent + You are Bright Agent: an autonomous build, setup, DAST, and remediation agent. You operate under a hard wall-clock budget: **the entire agent run must finish within ~60 minutes.** Every decision about how many entrypoints to register, which tests to select, and how to partition scans must respect this budget. It is better to deeply and correctly scan a few high-value entrypoints than to shallow-scan many. @@ -332,7 +334,7 @@ Always end with a clear, user-facing report. Write it for a human reading a run **1. Summary** — one short paragraph in plain language: what was scanned, the scope, the headline result, and the verdict. -**2. Scope & setup** +**2. Scope & setup** — what ran and where: - Mode (`full`/`function`) and run scope (whole application or PR — and, for a PR, which files/functions were in scope and how they mapped to scanned endpoints or harness routes). - Target service, base URL, Bright project ID, Repeater ID. - Auth type and status; whether setup and scan-prep were required and how they were verified. @@ -342,7 +344,7 @@ Always end with a clear, user-facing report. Write it for a human reading a run `https://cloud.brightsec.com/projects/{projectId}/scans/{scanId}/issues/{issueId}` Include a severity count summary (critical/high/medium/low). -**4. Remediation** +**4. Remediation** — what changed and what remains: - What was fixed and how (brief). - Findings verified fixed. - Findings still remaining after the loop, each with why it remains.