> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Work with an agent

> Let an AI agent register vulnerabilities, link product families, draft reports for you to review and track deadlines. It can't file, approve or send.

> [!NOTE]
>
> **Plans:** Every plan and the free trial. A read-only workspace can only read. **Who:** owners and admins allow agents; any member can then connect one, with no more rights than their own.

An agent such as Claude can do the legwork on a case: register a vulnerability for the affected product families, draft the early warning, and keep track of what's due. It works through the [Pharus MCP server](https://docs.pharussecurity.com/api-reference/mcp-server.md), for the person who connected it.

Agents draft; people decide. Pharus never files with the authorities, and an agent can't either: the SRP has no API, so a person files there.

## What an agent can and can't do

| An agent can | Only a signed-in person can |
| - | - |
| Read vulnerabilities, incidents, deadlines, SBOMs, advisories and the audit trail | Start or correct the clocks |
| Register a vulnerability, which opens an incident to be assessed | Record, approve or decline a determination |
| Link another product family to a registered vulnerability | Mark a report as submitted, record a receipt, void a filing |
| Propose text for a CRA report | Accept that text into the pack, and edit the pack |
| | Set a VEX status, say a fix is available, close or reopen an incident |
| | Publish an advisory, reply to a reporter, inform users, send a page |

These limits are in Pharus, not in the agent's instructions. No token can do what's in the right-hand column, whatever the agent asks or the person's role.

## Allow agents in your workspace

Every workspace starts with agents off.

**1. Open the setting**

Go to **Settings → API tokens**. The **Agents** card is below your tokens.

**2. Turn them on**

Select **Allow agents**. The audit trail records who did.

**Stop allowing agents** refuses every connected agent from its next request. Their connections stay, and start working again if you allow agents again.

## Connect an agent

**1. Add Pharus to your agent**

Add `https://mcp.pharussecurity.com/mcp` to your agent. See [connect a client](https://docs.pharussecurity.com/api-reference/mcp-server.md#connect-a-client).

**2. Sign in**

Your agent opens Pharus in your browser. Sign in as usual, with two-step verification if you use it.

**3. Check who is asking**

The page shows the name the agent gave itself and the address it will send you back to. If it publishes its details, the page says where, which shows who controls that address, not that you can trust it. **Unverified** means it only named itself. Either way, connect it only if you started this and trust the address shown.

**4. Choose the workspace and what it may do**

The connection belongs to one workspace. **Read the workspace** is always on. Untick **Register vulnerabilities and draft reports** for an agent that should only read.

**5. Select Connect**

You go back to your agent.

If your workspace doesn't allow agents yet, the page says so. An owner or admin turns them on under **Settings → API tokens**, then reloads the page. Connecting and allowing are separate on purpose: a link from someone else shouldn't be one click from opening your workspace.

> [!WARNING]
>
> What the agent reads goes to the agent and whoever runs it, under your agreement with them. Pharus doesn't choose or control that. Check that it fits how you handle vulnerability information before you connect one.

## Register a vulnerability

Ask your agent to register a vulnerability, with its CVE, GHSA or EUVD id or your team's own id, and the product families it affects. For each family, Pharus opens an incident **being assessed**, the same state an exploited match opens one in, titled from the id and the family:

* **No clock runs.** A person says whether it's exploited in your product, and that starts the 24-hour clock. See [clocks](https://docs.pharussecurity.com/incidents/clocks.md).
* **One incident per family.** Each has its own clocks, its own pack and its own route. Incidents for the same vulnerability share its id. If a family already has an incident for the id, the agent gets that one back, so asking twice changes nothing.
* **What the agent says stays its own.** It shows on the incident's **Overview**, marked as coming from the agent, for whoever assesses it. It isn't in any report. The agent's words reach a pack only through a draft you accept. Versions and member states come from the SBOMs and the product family, not the agent.
* **It takes no alert's place.** If CISA KEV, EUVD or CISA SSVC lists the vulnerability, Pharus opens its own incident and alerts and pages as usual, whether the agent's incident is open or closed. Close one of them as a duplicate.
* **Owners and admins are told by email**, as are your Slack, Teams and webhook destinations. Nobody is paged when it opens. If nobody has assessed it after 4 hours, the usual reminder goes out and on-call is paged, as for any incident being assessed.

Agents can open at most 20 incidents per workspace in 24 hours.

A vulnerability that no SBOM in the workspace matches appears under **Incidents**, not on the [Vulnerabilities list](https://docs.pharussecurity.com/monitoring/vulnerabilities.md).

## Review a draft

An agent's text for a report waits outside the pack. The incident's **SRP pack** tab says so at the top, with who proposed it and any note.

**1. Select Review the draft**

**Edit pack** opens with the agent's text filled in where the field was empty or still auto-filled, marked **Agent**. Where you have written text of your own it stays, and **Use the agent's text** swaps it in.

**2. Read it**

Any gap the agent left, `[[like this]]`, counts as missing. Pharus also flags ids and links in the text that aren't in the incident's record, so you can check them.

**3. Save the pack**

**Save pack** puts it in the pack as yours. The agent's proposal is then accepted, and the audit trail records you as accepting it.

Or select **Dismiss** to drop the proposal and leave the pack as it is.

An agent can propose text for the prose fields only, in the early warning, the notification and the final report. Awareness times, identity fields and yes-or-no fields are never an agent's: Pharus fills them from the record, or you do. It can't draft notices under other regimes.

Filing works as always: you paste the pack into the SRP, then select **Mark as submitted**. See [SRP paste pack](https://docs.pharussecurity.com/incidents/srp-pack.md).

## Track deadlines

Ask your agent what's due. It lists every deadline, nearest first: reports due on open incidents under every regime, assessments still to do, and [fix deadlines](https://docs.pharussecurity.com/monitoring/fix-deadlines.md).

## See what agents did

The [audit trail](https://docs.pharussecurity.com/reports/audit-trail.md) records an agent as itself, on behalf of the person who connected it: "Claude (agent) for Kari Nordmann". Filter by **Actor → Agents** to see what agents did, or **Type → Agents** to add what people did about it. Filtering by a person shows only what they did themselves.

An agent's name is what its client calls itself, so it isn't proof of who it is. The person who connected it and the address it sent them back to are what you can rely on. **Settings → API tokens** shows both, marked **Published** if it publishes its details and **Unverified** if it only named itself.

When someone marks a report as submitted, the entry counts the fields filed exactly as an agent wrote them.

## Disconnect an agent

Under **Settings → API tokens**, select **Disconnect** next to the agent. It loses access at once. Everyone sees the agents they connected themselves; owners and admins see everyone's and can disconnect any of them.

An agent is also disconnected when the person who connected it leaves the workspace or resets their password. Signing out doesn't disconnect it.

## Related

> [card] [MCP server](https://docs.pharussecurity.com/api-reference/mcp-server.md)

> [card] [SRP paste pack](https://docs.pharussecurity.com/incidents/srp-pack.md)

> [card] [Clocks](https://docs.pharussecurity.com/incidents/clocks.md)

> [card] [Audit trail](https://docs.pharussecurity.com/reports/audit-trail.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.