Skip to main content
Research doesn’t just answer questions. It reads your code, queries your cloud, triages findings, and runs workflows.

​
Capabilities

Read findings, change their status (up to 100 at once), and rewrite their details. Research can’t create findings. See Findings and triage.
Query the graph that links your code, cloud, identities, and findings, to trace attack paths and blast radius.
Run read-only aws, gcloud, and az rest commands against your connected accounts.
Read Enclave’s CVE intelligence and NVD data, and start research on a new CVE.
Clone your repositories, read and search files, and run commands in a sandbox. The sandbox starts without network access.
Search the web and read pages, such as vendor advisories and changelogs.
Ask you for a secret through a secure card, and use saved secrets to call external APIs.
Show a Connect card for a missing integration, and read or change organization settings.
Write files in the sandbox and share them with you as downloads.

​
Approvals

Before Research changes anything, it shows a card. Click Approve or Deny. Research asks before it:
  • Changes a finding’s status or details
  • Starts new CVE research
  • Turns on network access in the sandbox
  • Changes organization settings
  • Starts, pauses, resumes, or stops a workflow run
  • Saves a proposed workflow
Cards don’t expire. A card waits until you answer it, or until you send a new message, click Stop, or delete the session, which cancel it.

​
Background agents

For larger tasks, Research can start up to 4 background agents that work in parallel while you keep talking. Each one appears as a card with Inspect and Stop buttons. Within 7 days of an agent finishing, ask Research to send it a message, and it continues with its earlier work.

​
Workflows

Ask Research to find, start, pause, resume, stop, or build a workflow. Starting a run shows a card with inputs and a budget for you to approve. When a run finishes or pauses at its budget, a notice appears in the conversation.

​
Permissions

Research only uses the tools your role allows. For example, cloud commands need permission to read assets, and starting a run needs permission to run agents.