# Fixing with your agent

> Every finding comes with a prompt that any coding agent can act on, and RedNest checks the fix for you.

Every finding has a **fix prompt**: one Markdown document that gives a coding agent everything it needs to fix the vulnerability and prove it's fixed. Use it with any agent, or as a checklist for fixing it yourself.

## What the prompt contains

- the vulnerability, its severity and CWE, and where it lands, by file and line
- how it is reached and who can exploit it
- the attack path, step by step, with code excerpts
- the proof of concept
- how to fix it, what the fix must guarantee, and what it must not break
- a regression test that reproduces the attack

It ends by asking the agent to write the regression test first and confirm it fails, then make the smallest change that closes the attack path, and confirm the test passes along with your existing tests.

The prompt quotes short excerpts of your code, so treat it like your code: paste it into tools you'd trust with the repository.

## From the dashboard

Open a finding from [Findings](https://rednest.tech/dashboard/findings). The fix prompt is shown on open findings; fixed and dismissed ones don't have one.

- **Copy fix prompt**, in the side column next to **Mark fixed** and **Dismiss**, copies the prompt in one click.
- The **Fix it with your agent** panel shows the prompt in three formats: **Prompt**, **Claude Code** and **Codex**. **Copy prompt** or **Copy command** copies whichever is showing.
- **Open in T3 Code**, **Claude Code**, **Codex** or **Cursor** opens the agent with the prompt filled in. See [Open in your agent](#open-in-your-agent).

## Open in your agent

The **Open in** buttons start a new session in your agent, in your own clone of the repository, with the fix prompt in its input. Nothing is sent until you read it and press send.

| Agent | Opens | Longest prompt in a link |
| --- | --- | --- |
| T3 Code | a new thread in the project you last used for the repository | 8,000 characters |
| Claude Code | a terminal in the clone where you last ran `claude` | 5,000 characters |
| Codex | a new chat in the workspace whose Git remote is the repository | no documented limit |
| Cursor | the chat in the window you have open | about 10,000 characters, once encoded for a link |

A longer prompt still opens the agent: RedNest copies the prompt to your clipboard first, and you paste it in (⌘V or Ctrl+V) before sending.

The agent has to be installed on the computer you click from. Claude Code needs version 2.1.91 or later, and opens links only after you've sent it a message once on that computer. T3 Code needs v0.1.6 or later: earlier builds lose the prompt when a thread is open, and say the link has no prompt. If nothing happens when you click, that's usually why.

The buttons open each app directly, so the prompt, which quotes your code, goes straight to the app on your computer and never through a website.

## Many findings at once

**Copy N findings**, at the top of [Findings](https://rednest.tech/dashboard/findings), takes every finding the list shows, with your status, severity, repository and confidence filters.

- **Open in** opens one prompt covering all of them in T3 Code, Claude Code, Codex or Cursor. The findings have to be in one repository, so filter first if they aren't. A prompt too long for the agent's links is copied for you to paste in.
- **Copy** gives the same prompt to paste into any agent, or as a Claude Code or Codex command. On open findings only: fixed and dismissed ones have nothing left to fix.
- **Markdown** copies a report, with a summary table and each finding in full, for an issue, a doc or a chat. **JSON** copies the findings as data. Neither includes code excerpts.

The prompt for many findings has the agent take them one at a time: confirm each against the current code with a failing regression test before changing anything, leave alone any that no longer hold, keep each fix separate, and finish with a report on every finding: fixed, with the test that proves it, or not, and why. Findings across several repositories are listed so the agent fixes only the ones in its own.

### Claude Code and Codex one-liners

The Claude Code and Codex tabs wrap the prompt in a shell command you can paste into a terminal at the root of your repository:

```bash
claude "$(cat <<'SANDCHEST'
Fix this high-severity security vulnerability: …
SANDCHEST
)"
```

```bash
codex "$(cat <<'SANDCHEST'
Fix this high-severity security vulnerability: …
SANDCHEST
)"
```

The quoted heredoc passes the prompt to the agent exactly as written: quotes, backticks and dollar signs in it are not touched by your shell.

## From your agent

With RedNest connected to your agent ([Use it from your agent](https://rednest.tech/docs/agents)), ask it to fix your open findings. It calls `list_findings`, then `get_fix_prompt` for each one, and works from the prompt in your checkout. `get_finding` has the same evidence broken into fields: the attack path, the proof of concept, what the fix must guarantee and the regression test. Once the fix is merged, it can call `update_finding` to dismiss what you decide not to fix, with a reason.

## From a pull request

On private repositories, each finding is posted as a review comment on the last step of its attack path that is inside the diff (or in the review's summary, if none is), and ends with a collapsed **Fix prompt for your coding agent**. Expand it, copy the prompt, and give it to your agent on the pull request's branch. When you push the fix, the pull request is reviewed again.

On public repositories the prompt isn't posted, because review comments are public. Use **View privately** on the Check to open the findings in the dashboard.

## After the fix

You don't have to close findings by hand. When the fix reaches your default branch, a [fix check](https://rednest.tech/docs/scans#fix-checks) re-checks the finding on the new code and marks it **fixed** if the attack path is gone. It's free.

You can also press **Mark fixed** on the finding yourself. If a later scan finds the same vulnerability again, it shows up as open.