What does AI do in SuperClue?

You connect a repository with a personal access token, which SuperClue stores encrypted. AI then reads the code and returns findings tagged with CWE and OWASP categories.

• Providers: GitHub, GitLab (gitlab.com), Bitbucket and Azure DevOps.
• Up to 80 files per review, and up to 300 KB per file.
• 31 languages and formats, including Python, JavaScript, TypeScript, Java, Go, C#, PHP, Terraform and Dockerfile.
• Pull request review, scheduled reviews, custom pattern rules and SARIF export.
• 25 credits per repository review and 10 credits per pull request review.

Your code is sent to a third-party AI service for analysis. If the AI service is not configured, the review reports that and you are not charged. This is separate from the pattern-based basic SAST scan.

For a scan finding or a CVE, AI writes a code or configuration fix suggestion for that issue. Each suggestion costs 4.76 credits. When AI is unavailable, SuperClue falls back to a built-in template fix for the vulnerability type.

For a detected breach, AI drafts a threat analysis: likely root cause, containment steps, recovery recommendations, a risk rating and a narrative you can adapt for a CERT-In report. When AI is unavailable, you get a clearly labelled template analysis instead. For attack campaigns, AI drafts a write-up that references MITRE ATT&CK techniques. See SOC docs.

The Windows Fleet agent uses AI-assisted classification to rate visited domains by risk for browsing control. Domains are classified in batches of 20, at 2 credits per batch.