Install
Add the marketplace, take the families you need
$ /plugin marketplace add apache/magpie
Added marketplace apache-magpie (12 plugins)
$ /plugin install magpie-setup@apache-magpie
$ /plugin install magpie-security@apache-magpie
$ /plugin install magpie-agent-guard@apache-magpie
Installed: magpie-setup, magpie-security, magpie-agent-guard
Nothing committed — the install is yours, on this machine.
Set up
The one command worth memorising
$ /magpie-setup
Detected example-org/example-app
Tracker example-org/example-app-security · list [email protected]
Write this to .magpie-local/ (gitignored)? — answered "y"
Recommended next, and each is its own step:
· isolate this agent · install the action guard
· prepare the security model
Isolate & guard
Two layers about what the agent can reach and what it can run
Magpie did that: Wrote the sandbox profile and wired the guard hook — 6 h of setup, across the team last month.
You: set up isolation and the action guard
Sandbox: Seatbelt — Bash subprocesses see only the paths you allow
Apply 3 settings changes and 1 sudo step? — answered "y"
~/.ssh, ~/.aws and your tokens are out of reach
magpie-agent-guard: PreToolUse hook now inspects every shell command
✗ denied: force-push to a protected branch. The guard refuses — no prompt to click through.
Privacy
The layer that is about other people's data, not your machine
Magpie did that: Pinned the approved models and wired redaction before any fetch — 3 h of privacy review last month.
You: set up privacy for this project
Approved-LLM gate: a private-list fetch refuses unless every model in the stack is approved
PII redaction: names and addresses → N-a3f9d2, E-7c1b04 before a model sees them
The mapping that reverses it stays on this machine and is never sent anywhere.
Record the approved model registry for this project? — answered "y"
Sandboxes stop the wrong command. This stops the right command exporting someone else's mail.
Security
Tell the security family what this project is
Magpie did that: Drafted the security model and wired the tracker conventions — 5 h of policy-wrangling last month.
You: prepare the security model for this project
Read the code, the docs and 2 years of advisories
Drafted: trust boundaries · what is in scope · what is not
Open a PR adding SECURITY.md and the tracker conventions? — answered "y"
A written model is what lets the next report be routed without a meeting.
Import
Ask for exactly the window you care about
Magpie did that: Read the list and opened both issues — 6 h of copy-paste last month.
You: sync the security issues that arrived in the last 2 days
[email protected] — 2 unimported reports
1. "path traversal in archive extractor" — [email protected]
2. "login page is slow" — [email protected]
Open 2 issues in example-org/example-app-security? — answered "y"
Opened #41 and #42. Identifiers are public; contents stay private.
Triage
Classify, check the history, agree a disposition
Magpie did that: Checked 148 past issues for duplicates — 9 h of searching last month.
You: triage the two new reports
#41 archive extractor — path traversal on member names
Severity: high · CWE-22 · affects 3.0.0 – 3.2.0
Related to #12 (fixed 2024) — different code path, not a duplicate.
Team thread: 3 replies, disposition agreed — accept, fix in 3.2.1
#42 login page is slow — no security impact
Close #42 as not-a-vulnerability, with a reply? — answered "y"
Reply to the reporter — written in an instant, sent by a human
Magpie did that: Drafted the reply, with the history it just checked — 4 h of writing last month.
To: [email protected]
From: [email protected]
Subject: Re: path traversal in archive extractor
Hello,
Thank you for the report. We have confirmed the issue and are
tracking it privately; it is not related to the 2024 report you
may have seen, which touched a different code path.
We will request a CVE and let you know before the advisory is
published, so you can check the credit line reads the way you
want it to.
Please keep the details private until then.
-- the Example App security team
Plain text, real links, no tracking. Magpie wrote it; you send it.
Board
The same issue, on the tracker board
Columns: Reported → Triaged → Fix in progress → Fix ready → Released
#41 Path traversal in archive extractor — Reported to Fix in progress
#42 Login page is slow — closed, not a vulnerability — Reported to Reported
Triaged — severity high, assigned
Picked up for a fix
…and the fix opens itself
Opened the fix PR on a private branch, with the test that proves it — 7 h of fix-shepherding last month.
Pull request example-org/example-app#8317: Normalise archive member paths before extraction
+ 24 −3 src/extract.ts
+ 61 −0 test/extract_traversal_test.ts
private branch · linked to #41 · awaiting review
Reviewed, merged, released
Columns: Reported → Triaged → Fix in progress → Fix ready → Released
#41 Path traversal in archive extractor — Fix in progress to Released
#42 Login page is slow — closed, not a vulnerability — Reported to Reported
Reviewed and merged
Example App 3.2.1 released
Learn
The model learns from what you just decided
Magpie did that: Turned two dispositions into a sharper security model — 4 h of model upkeep nobody ever gets to last month.
You: update the security model with what we learned from #41 and #42
Reading both dispositions and the fix that landed
#41 accepted → archive extraction is now a named trust boundary
#42 rejected → page latency is stated out of scope, so the next one routes itself
Open a PR updating SECURITY.md with both? — answered "y"
Every report makes the model sharper instead of leaving it staler.
Publish
The CVE record
Magpie did that: Filled the CVE record from the issue and the fix — 3 h of form-filling last month.
CVE ID: CVE-2026-XXXXX
Product: Example App (example-org)
Affected: 3.0.0 – 3.2.0
Fixed in: 3.2.1
CWE: CWE-22 — path traversal
CVSS: 7.5 (high)
Credit: R. Chen
References: example-org/example-app#8317
Submit the record to the CVE program?
Announce it — written in an instant, sent by a human
Magpie did that: Drafted the advisory from the record and the fix — 3 h of writing last month.
To: [email protected]
From: [email protected]
Subject: [CVE-2026-XXXXX] Path traversal in Example App archive extractor
CVE-2026-XXXXX: path traversal in the Example App archive extractor
Severity: high (CVSS 7.5, CWE-22)
Affected: 3.0.0 through 3.2.0
Fixed in: 3.2.1
An archive member name was joined to the extraction directory
without normalisation, so a crafted archive could write outside
it. Upgrade to 3.2.1. There is no workaround.
Credit: R. Chen, who reported it privately and followed the
embargo throughout.
https://example.org/security/CVE-2026-XXXXX
The last gate in the story — and a person is still the one pressing it.
Closed — and off the board
Magpie did that: Closed #41 — advisory out, nothing left to chase — 31 h across 12 reports last month.
Columns: Reported → Triaged → Fix in progress → Fix ready → Released
#41 Path traversal in archive extractor — closed — Released to Released
#42 Login page is slow — closed, not a vulnerability — Reported to Reported
CVE-2026-XXXXX published — closing #41
Board clear. Nothing left open.
Published
ID: CVE-2026-XXXXX
Published: 2026-09-13
Severity: 7.5 HIGH
Weakness: CWE-22
Status: Analyzed
One report, one fix, one release, one advisory — and every message that left the project was written by Magpie and sent by a person.
