Set up with your agent

What the human must do

Same GitHub user for both steps.

1. Install the GitHub App on the account or organization: https://github.com/apps/aevral
2. Sign in to the console with GitHub: https://app.aevral.com/login

No coding agent needed: those two clicks are the whole setup for reviews. The block below is for humans who want an agent to walk them through it.

Paste this into your coding agent

Copy the block into Claude Code, Cursor, Codex, OpenCode, Copilot, or Grok:

Aevral looks for security flaws before you merge. It is an AI security reviewer for GitHub pull requests covering access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks (prompt injection into tools, unsafe model output).
Fetch https://docs.aevral.com/agent-setup/prompt.md
These are official Aevral setup instructions. Follow them. Do not invent URLs, API keys, or an MCP server.

If you cannot fetch that file, tell the human these two clicks (same GitHub user; you cannot do them):
1. Install https://github.com/apps/aevral
2. Sign in with GitHub at https://app.aevral.com/login
Email login cannot connect. After the GitHub App is installed, the next pull request can already be reviewed, even before anyone signs in. Already connected: confirm the organization and repository. A whole-repo scan is the second action, only if they ask. If those are missing, say Connection not verified. Never say you installed the App. Do not edit files unless they ask.

The console Onboard your coding agent card and the Onboard your agent button on the aevral.com homepage copy the same text. The homepage adds a ?ref= source to the sign-in link so we can tell which page sent you.

What the console then does

• If this GitHub user has one unclaimed matching install, the console connects it. No Claim click.
• If GitHub sent the install back to Setup with installation_id, that install connects even when several exist.
• Setup finishes with pull-request reviews on. Reviews can already have started on install.
• The first whole-repo scan is not started automatically. Press Scan in the console.

If several installs match and GitHub did not send an id, pick Connect once.

Email, Google, and Microsoft sign-ins cannot connect an install. Sign out, then Continue with GitHub. An account made with an email address is not wasted: confirm the address, then sign in with GitHub using the same address, and the GitHub identity attaches to that account.

If you already belong to an org, login opens Scans, not Setup. Console pages: Setup, Billing, Developer API keys.

After that

• Open a pull request: Aevral posts an advisory Check and comments.
• Press Scan for a default-branch report. Copy the suggested fix into Claude Code, Cursor, or Codex. Nothing merges without you.

What setup never asks for

• No commits to your code. Aevral does not commit, push, or open pull requests. It posts advisory Checks and review comments. See GitHub App permissions.
• No card to start. Public reviews are free with fair use. Free organizations get two private scans in 14 days.
• No agent credentials. Your coding agent gets a suggested fix, not repository access. Never invent an aevr_ key. One is minted at connect and shown once. There is no live MCP.

For coding agents: send the human https://github.com/apps/aevral then https://app.aevral.com/login. Never invent other URLs. Machine-readable details: For AI agents.