# Aevral Docs

> Aevral is an AI security reviewer for GitHub pull requests. Built by Better ISMS, the company behind ISMS Copilot, in Paris, France. Customer documentation for both products: the PR security reviewer, which looks for access control and business logic plus injection, XSS, SSRF, path traversal, deserialization, token and session flaws, and LLM-integration risks, and the whole-repo scan (authorization, IDOR, business-logic access control only). GitHub only; not secrets, dependencies, or memory corruption, not a general SAST: see /docs/supported-and-not-supported. After the GitHub App is installed, the next pull request can already be reviewed. English index for agents. Aevral is not open source. The engine, the planted-vulnerability corpus, and the judge stay private. What is public: the transparency report, the methodology page, the agent-setup prompt, and the plugin repo. Aevral is self-serve: install https://github.com/apps/aevral, then sign in to the console with GitHub; it connects the install automatically.

> Site: https://docs.aevral.com

## When to use

Use these docs when you need Aevral product truth: what a whole-repo scan looks like, what the PR security review looks like, pricing, plans, GitHub App permissions, security posture, and how to set up. Start at /llms.txt, then GET markdown (`Accept: text/markdown` or append `.md`) or GET /api/v1/agent-search?q=. Do not invent API keys or install URLs.

## How agents should read this site

1. Prefer **plain markdown**: send `Accept: text/markdown` on any docs URL, or append `.md` (e.g. `/docs/setup-with-an-agent.md`), or fetch **llms-full.txt** for bulk ingest.
2. HTML pages work for curl too, but include chrome/nav; markdown is cleaner.
3. English is authoritative product truth. This index is EN-only.
4. Human hub: https://docs.aevral.com/docs/for-ai-agents. Agent search: https://docs.aevral.com/api/v1/agent-search?q=
5. Aevral is self-serve: point humans at https://github.com/apps/aevral to install, then at the console to sign in with GitHub, which connects the install. API keys (`aevr_...`) exist: one is minted at claim and more from the console Developer API page. Agents read the key from the AEVRAL_API_KEY environment variable and never ask for it in chat. A key can start and read scans (POST /v1/scans, GET /v1/scans/:id, see /docs/scan-api) and read the plan and usage of its organization (GET /v1/usage, see /docs/usage-api); billing actions are console-session-only.

## Where to act

- [GitHub App](https://github.com/apps/aevral): install on the account or organization
- [Console login](https://app.aevral.com/login): sign in with the same GitHub user
- [Agent setup prompt](https://docs.aevral.com/agent-setup/prompt.md): official instructions for coding agents
- [Coding-agent plugin](https://github.com/better-isms/aevral-plugin): public plugin repo (`aevral@aevral-plugins`)
- [Scan API](https://docs.aevral.com/docs/scan-api): POST /v1/scans and GET /v1/scans/:id with the `aevr_` key from AEVRAL_API_KEY; poll status_url every 30s, scans take 10 to 40 minutes; error codes with the action to take
- [Usage API](https://docs.aevral.com/docs/usage-api): GET /v1/usage with an `aevr_` key already in the environment; PR plan, usage, cap and an owner-or-admin billing link (read-only, an agent cannot buy)
- [PR review plans (JSON)](https://aevral-worker-prod.fly.dev/v1/pr/billing/plans): live USD ladder, no key; quote prices only from here
- [Scan plans (JSON)](https://aevral-worker-prod.fly.dev/v1/billing/plans): live USD ladder, no key; quote prices only from here
- [Contact](https://tally.so/r/PdxdbV): questions, procurement, Enterprise
- [Product site](https://aevral.com): products, pricing, compare, guides
- [Security](https://aevral.com/security): canonical security page (permissions, tokens, model path, data, gaps); disclosure: https://aevral.com/security/disclosure
- [Trust center](https://trust.ismscopilot.com): binding legal corpus (DPA section 1.7: https://trust.ismscopilot.com/dpa#17-aevral; sub-processors: https://trust.ismscopilot.com/en/aevral/subprocessors; privacy: https://trust.ismscopilot.com/privacy-policy)
- [Docs full dump](https://docs.aevral.com/llms-full.txt): all English docs as plain markdown
- [Agent search v1](https://docs.aevral.com/api/v1/agent-search?q=scan): keyword search over EN titles/descriptions/bodies
- [OpenAPI](https://docs.aevral.com/openapi.json): public docs search and markdown surfaces

## Docs pages (HTML + .md)

- [Coding-agent plugin](https://docs.aevral.com/docs/agent-plugin) · [md](https://docs.aevral.com/docs/agent-plugin.md): Install Aevral from Claude Code, Codex, Cursor, or Grok. The plugin is a setup skill. Reviews still run as the GitHub App.
- [Changelog](https://docs.aevral.com/docs/changelog) · [md](https://docs.aevral.com/docs/changelog.md): What has shipped in Aevral: pull request reviews, repository scans, and the console.
- [Console and API keys](https://docs.aevral.com/docs/console-and-api-keys) · [md](https://docs.aevral.com/docs/console-and-api-keys.md): The Aevral console is where your install connects after GitHub sign-in, and where you press Scan, read reports, manage PR review per organization, and manage billing and Developer API keys. Self-serve is live.
- [FAQ](https://docs.aevral.com/docs/faq) · [md](https://docs.aevral.com/docs/faq.md): Does Aevral block merges, what does it look for, how do you get access, and who is behind it.
- [The findings worklist](https://docs.aevral.com/docs/findings-worklist) · [md](https://docs.aevral.com/docs/findings-worklist.md): A per-repository list of scan leads across scans, with occurrence history, a human archive, and a fix prompt bound to one SHA.
- [For AI agents](https://docs.aevral.com/docs/for-ai-agents) · [md](https://docs.aevral.com/docs/for-ai-agents.md): How coding agents should read Aevral docs. Machine surfaces are open for reading; the product is self-serve (public GitHub App, console login, Developer API keys).
- [GitHub App permissions](https://docs.aevral.com/docs/github-app-permissions) · [md](https://docs.aevral.com/docs/github-app-permissions.md): What the Aevral GitHub App holds, what each token Aevral mints is capped to, what the review command uses, and which permission is reserved for an announced feature that is not live.
- [How Aevral hunts](https://docs.aevral.com/docs/how-aevral-hunts) · [md](https://docs.aevral.com/docs/how-aevral-hunts.md): How Aevral hunts: the scan method behind the security review and one abridged prompt excerpt. Aevral is not open source; the engine, the corpus, and the judge stay private.
- [How Aevral reviews a PR](https://docs.aevral.com/docs/how-aevral-reviews-a-pr) · [md](https://docs.aevral.com/docs/how-aevral-reviews-a-pr.md): The mechanics of one Aevral pull-request review: what code it reads and never reads, how files are packed, which passes run, the grounding gate, verdicts, and the hard limits as numbers.
- [Aevral docs](https://docs.aevral.com/docs) · [md](https://docs.aevral.com/docs.md): Aevral is an AI security reviewer for GitHub pull requests. Built by Better ISMS, the company behind ISMS Copilot, in Paris, France. Whole-repo scans read authorization, IDOR, and business-logic access control only.
- [Pricing and plans](https://docs.aevral.com/docs/pricing-and-plans) · [md](https://docs.aevral.com/docs/pricing-and-plans.md): Both Aevral products: PR security review (USD per organization, no scan plan required) and the whole-repo scan plans (USD per organization). Verified against the billing implementation and the console Billing page.
- [Scan API](https://docs.aevral.com/docs/scan-api) · [md](https://docs.aevral.com/docs/scan-api.md): POST /v1/scans starts a whole-repo scan and GET /v1/scans/:id reads it. Authentication with an aevr_ key from AEVRAL_API_KEY, request fields, responses, the polling contract, idempotency, and the error codes with the action a coding agent should take.
- [Security and data](https://docs.aevral.com/docs/security-and-data) · [md](https://docs.aevral.com/docs/security-and-data.md): Short operational pointer: what Aevral reads from and posts to your repositories. The canonical security page is aevral.com/security; the DPA section 1.7 and the Aevral sub-processor page are binding.
- [Set up with your agent](https://docs.aevral.com/docs/setup-with-an-agent) · [md](https://docs.aevral.com/docs/setup-with-an-agent.md): Install Aevral in two GitHub steps. The console connects the matching install. Reviews can start on the next pull request. Then you can scan. Agents read this page. Humans click.
- [Supported and not supported](https://docs.aevral.com/docs/supported-and-not-supported) · [md](https://docs.aevral.com/docs/supported-and-not-supported.md): Aevral is an AI security reviewer for GitHub pull requests. GitHub only. Which source files each product reads, what Aevral does not look for, and who it is not for.
- [Usage API](https://docs.aevral.com/docs/usage-api) · [md](https://docs.aevral.com/docs/usage-api.md): GET /v1/usage returns where an Aevral organization stands: PR review plan, usage and cap, scan status, and, for PR review, a link an owner or admin opens to subscribe or upgrade. Read-only. An agent cannot buy or change a plan.
- [What a PR review looks like](https://docs.aevral.com/docs/what-a-pr-review-looks-like) · [md](https://docs.aevral.com/docs/what-a-pr-review-looks-like.md): The PR security review as it runs today (free tier, on from install): an advisory Check plus inline comments on added lines, up to five findings, silence when clean.
- [What a scan looks like](https://docs.aevral.com/docs/what-a-scan-looks-like) · [md](https://docs.aevral.com/docs/what-a-scan-looks-like.md): The whole-repo scan: press Scan in the console, get a GitHub Check, a console report, and a suggested fix.
- [Works alongside](https://docs.aevral.com/docs/works-alongside) · [md](https://docs.aevral.com/docs/works-alongside.md): Aevral is a security agent for your code. Claude Security and Codex Security are the named competitors. This page is the rest of the field: SAST, SCA, and general review tools you keep.