Docs | Cantina AI

Apex docs

Connect your agent, review your findings, and fix vulnerabilities without leaving your workflow.

Your scan, in your agent.

Open your repository, then paste this into your agent's chat.

Read https://ai.cantina.xyz/docs/agents.md and connect Apex to my agent.

Connects to your existing workspace and reads results. Setup does not start a new scan.

How the docs are organized

The Apex docs are organized around the workflow most teams follow: connect code, define the workspace, choose the right scan workflow, and then run or automate it from the app, GitHub, or CLI.

Use this page as the entry point when you are deciding which guide belongs to the next step in setup or scan planning.

Key idea

Already ran a scan? Connect your agent to the same workspace to read your results and prepare fixes. For each guide below, use Copy agent prompt to bring that workflow into your agent.

Guides

Use your agentConnect your agent Copy one prompt to connect Claude Code, Codex, Cursor, or Copilot and review the scan you already ran.Start hereClient onboarding Connect GitHub or GitLab, choose repositories, and send the context Apex needs before the first scan.Manage scopeWorkspace management Edit workspace scope, archive inactive workspaces without deleting history, and restore them from company home.Run scansFix Review workflow Verify proposed fixes end to end, from single findings through agent handoff, bulk review, scheduled rechecks, and provider comments.Run scansApex scan manual Choose between full scans, PR scans, and Fix Review; explain the threat model; and split larger repos into useful review units.Automate scansScheduled scans Turn on recurring workspace scans or Fix Review, choose a daily or weekly cadence, and keep monitoring without manual runs.ReferenceApex CLI guide Install the CLI, wire Apex into Claude Code, Codex CLI, or GitHub Copilot CLI, and drive scan workflows from the terminal.ReferenceApex service API Connect production agents over hosted HTTPS MCP, or use REST to trigger scans, poll status, and retrieve findings.

Scan workflow

Apex works best when the workspace reflects a real security surface, not a loose collection of unrelated directories. The path below keeps access, scope, context, and scan type aligned before work starts.

Connect a code host or use the CLI from the repository you want to scan.
Create a workspace and choose the repositories, branches, pull requests, or commits in scope.
Add private docs, architecture notes, API specs, and threat model details that are not obvious from the code.
Run the workflow that matches the question: full scan for a system, PR Scan for a proposed diff, or Fix Review for an existing finding.
Use the CLI or workspace UI to track progress, read findings, and export results.

Before the first scan

Make sure the person approving repository access and the person deciding scan scope agree on the same repos, refs, and supporting materials.

PR scans and Fix Review

Not every security question needs the same scan shape. Apex now has focused workflows for pull request review and for verifying fixes against existing findings.

Use PR Scan when the review target is one or more GitHub pull requests or GitLab merge requests and you want focused diff coverage before merge.
Use Fix Review when an existing finding has a proposed fix and Apex should verify whether the original issue is actually resolved.
Use scheduled scans for recurring workspace coverage, and scheduled Fix Review when eligible findings should be rechecked automatically on a cadence.

Fix Review has its own workflow guide

Read the Fix Review workflow guide when you need the full path from fix target selection through provider handoff, bulk review, scheduled review, and final verdicts.

Reference

The CLI guide is the canonical reference for local and agent-driven workflows. The service API guide covers static-token, headless HTTP integrations for serverless workers and audit hubs.

Read client onboarding if you are setting up a workspace for the first time.
Read the scan manual before choosing between full scans, PR scans, Fix Review, or a split large-repo plan.
Use the CLI guide when you want Apex available directly inside developer and agent workflows.
Use the service API when a serverless function, cron job, or internal audit hub needs static-token HTTP access.