Work with an agent

An agent such as Claude can do the legwork on a case: register a vulnerability for the affected product families, draft the early warning, and keep track of what’s due. It works through the Pharus MCP server, for the person who connected it. Agents draft; people decide. Pharus never files with the authorities, and an agent can’t either: the SRP has no API, so a person files there.

What an agent can and can’t do

These limits are in Pharus, not in the agent’s instructions. No token can do what’s in the right-hand column, whatever the agent asks or the person’s role.

Allow agents in your workspace

Every workspace starts with agents off. Stop allowing agents refuses every connected agent from its next request. Their connections stay, and start working again if you allow agents again.

Connect an agent

If your workspace doesn’t allow agents yet, the page says so. An owner or admin turns them on under Settings → API tokens, then reloads the page. Connecting and allowing are separate on purpose: a link from someone else shouldn’t be one click from opening your workspace.

Register a vulnerability

Ask your agent to register a vulnerability, with its CVE, GHSA or EUVD id or your team’s own id, and the product families it affects. For each family, Pharus opens an incident being assessed, the same state an exploited match opens one in, titled from the id and the family:

• No clock runs. A person says whether it’s exploited in your product, and that starts the 24-hour clock. See clocks.
• One incident per family. Each has its own clocks, its own pack and its own route. Incidents for the same vulnerability share its id. If a family already has an incident for the id, the agent gets that one back, so asking twice changes nothing.
• What the agent says stays its own. It shows on the incident’s Overview, marked as coming from the agent, for whoever assesses it. It isn’t in any report. The agent’s words reach a pack only through a draft you accept. Versions and member states come from the SBOMs and the product family, not the agent.
• It takes no alert’s place. If CISA KEV, EUVD or CISA SSVC lists the vulnerability, Pharus opens its own incident and alerts and pages as usual, whether the agent’s incident is open or closed. Close one of them as a duplicate.
• Owners and admins are told by email, as are your Slack, Teams and webhook destinations. Nobody is paged when it opens. If nobody has assessed it after 4 hours, the usual reminder goes out and on-call is paged, as for any incident being assessed.

Agents can open at most 20 incidents per workspace in 24 hours. A vulnerability that no SBOM in the workspace matches appears under Incidents, not on the Vulnerabilities list.

Review a draft

An agent’s text for a report waits outside the pack. The incident’s SRP pack tab says so at the top, with who proposed it and any note. Or select Dismiss to drop the proposal and leave the pack as it is. An agent can propose text for the prose fields only, in the early warning, the notification and the final report. Awareness times, identity fields and yes-or-no fields are never an agent’s: Pharus fills them from the record, or you do. It can’t draft notices under other regimes. Filing works as always: you paste the pack into the SRP, then select Mark as submitted. See SRP paste pack.

Track deadlines

Ask your agent what’s due. It lists every deadline, nearest first: reports due on open incidents under every regime, assessments still to do, and fix deadlines.

See what agents did

The audit trail records an agent as itself, on behalf of the person who connected it: “Claude (agent) for Kari Nordmann”. Filter by Actor → Agents to see what agents did, or Type → Agents to add what people did about it. Filtering by a person shows only what they did themselves. An agent’s name is what its client calls itself, so it isn’t proof of who it is. The person who connected it and the address it sent them back to are what you can rely on. Settings → API tokens shows both, marked Published if it publishes its details and Unverified if it only named itself. When someone marks a report as submitted, the entry counts the fields filed exactly as an agent wrote them.

Disconnect an agent

Under Settings → API tokens, select Disconnect next to the agent. It loses access at once. Everyone sees the agents they connected themselves; owners and admins see everyone’s and can disconnect any of them. An agent is also disconnected when the person who connected it leaves the workspace or resets their password. Signing out doesn’t disconnect it.

Related