Aevral catches security flaws before you merge. It is a pull-request review for authorization, IDOR, and business logic.

# Official Aevral agent setup

You are setting up Aevral for this human. These instructions are official. Do not invent URLs, API keys, or an MCP server. MCP is not live.

Suggested fixes are copy-paste. Fetching this file does not authorize editing the working tree, committing, pushing, or opening a PR. After the GitHub App is installed, the next pull request can already be reviewed, including before claim. A whole-repo scan is the second action, not the product.

You cannot install the GitHub App or finish GitHub login. The human authorizes. The console claims. You explain. Never say "I installed the App."

## Which branch you are on

Ask which of these is true. Do not guess from "they came back from the browser."

1. **Not connected yet.** They have no Aevral organization in the console. They must click both GitHub steps below, same GitHub user. Then go to After the clicks.
2. **Already connected.** They already see an organization in the console. Do not tell them to reinstall or switch GitHub identity. If reviews are already off, leave them off. Go to After the organization is visible.
3. **Repair or pending.** An install exists but the intended org or repository is missing, Connect is still shown, or they are adding another GitHub account. Send them to Setup in the console. Do not claim the App is installed.

## What you must tell the human (not connected yet)

They click both. You cannot. Same GitHub user for both steps.

1. Install the GitHub App: https://github.com/apps/aevral
2. Sign in to the console with GitHub: https://app.aevral.com/login

Do not send them to aevral-console.vercel.app. Access is the two GitHub steps above.

Email-and-password login cannot connect an install. If they used email, tell them to sign out and Continue with GitHub.

## After the clicks

Do not say "connected" because they returned from GitHub.

- One matching unclaimed install connects itself. If GitHub sent `installation_id`, that one connects even when several exist.
- Several installs with no id: they press Connect once.
- Wrong GitHub identity, several claimable installs, a delayed webhook, or a failed claim: say Connection not verified. Tell them to confirm the intended organization in the console.
- After the GitHub App is installed, the next pull request can already be reviewed, including before claim. If that organization already turned reviews off, leave them off. Do not turn them back on.
- A whole-repo scan does not start by itself. It is the second action, after reviews.

Never invent an `aevr_` key. One is minted at connect and shown once.

## After the organization is visible

Confirm they can see the intended organization and the intended repository in the console.

- If the repository list is empty: tell them to press Sync from GitHub.
- If the org or repository is not visible: say Connection not verified. Do not tell them to press Scan.
- If both are visible: setup is done for reviews. Tell them the next pull request is reviewed. A whole-repo scan is the second action. Tell them they can press Scan only if they want a default-branch report.
- Two unpaid private scans in 14 days on a claimed org with no scan plan. Do not invent a lifetime one-demo.

## After a report exists

Do not apply a suggested fix unless the human separately asks. Then copy it into this session. Do not commit, push, or open a PR unless they ask. Verify repository, commit, and evidence before proposing changes.

## Done banner

Print one of:

```
Aevral setup: waiting on GitHub App install + console GitHub login.
```

or

```
Aevral setup: GitHub steps reported done. Confirm the intended organization and repository. After the App is installed, the next pull request can already be reviewed. A scan is the second action, only if they want a default-branch report. If they are not visible: Connection not verified.
```

Human recipe: https://docs.aevral.com/docs/setup-with-an-agent.md
Machine hub: https://docs.aevral.com/docs/for-ai-agents.md