This week’s roundup covers public Corgea releases from August 20 through September 3, 2026. The updates add review controls for triage decisions, Bitbucket support for running scans, and a CLI installer for connecting AI agents to Corgea. There are also improvements to dependency views, search, scan processing, and the CLI.

Top 3 features

1. Approval workflows for false positives and accepted risks

Company admins can now require a second reviewer before a false-positive or accepted-risk decision takes effect. When approval is required, a decision made from a finding, the Vulnerability Workbench, or bulk triage becomes a pending request. The finding keeps its current status until an eligible reviewer approves or rejects it.

The workflow includes a searchable review queue, reviewer notes, history, notifications, and a dedicated reviewer permission. Admins can enable separate controls for false positives and accepted risks under Settings → Company → Triage approvals. Accepted-risk approvals can also be configured by finding count or severity threshold, so teams can keep lower-impact decisions moving while routing broader or more severe actions for review.

2. Bitbucket support for running scans

Corgea now supports Bitbucket for running scans, including branch resolution and repository content retrieval. Teams can connect a Bitbucket workspace in Settings → Automation → Integrations, then use Corgea to scan projects and create fix pull requests from the platform.

The integration validates its credentials when it is created and configures webhooks automatically. It uses a Bitbucket API token from a workspace administrator, with repository, pull request, webhook, user, and workspace scopes. That gives teams using Bitbucket the same route into Corgea scanning and remediation workflows as the other supported source-control providers.

3. Install Corgea MCP from the CLI

CLI v1.13.0 adds corgea mcp install, which writes a logged-in Corgea MCP connection to the configuration used by a supported agent. The installer supports Cursor, Claude Desktop, Claude Code, Windsurf, VS Code, Gemini CLI, Continue, and OpenCode.

After corgea login, run corgea mcp install --agent cursor or replace cursor with another supported client. The installer can use user or project scope, refreshes an existing Corgea entry instead of duplicating it, and writes the configuration shape the selected client expects. Once the agent restarts, it can query scan results, issue details, dependency data, and blocking rules through Corgea MCP.

More features and improvements

  • Added incremental BLAST scans by default in CLI v1.12.0. The CLI compares a clean worktree with the last completed clean scan and analyzes changed files; --disable-incremental runs a full analysis.
  • Raised the default blocking-rules wait in the CLI to 35 minutes.
  • Updated dirty-worktree reporting so ignored or equivalent files do not force a full scan.
  • Added dependency license badges and license filtering, and placed direct dependencies ahead of transitive dependencies in dependency and SCA results.
  • Preserved SCA triage decisions across rescans when earlier findings are not linked in scan history.
  • Added direct installation of the Corgea plugin for IntelliJ IDEA from the Integrations page.
  • Added support for applying repository-defined policies during scans.
  • Redesigned the sidebar and settings experience, with reorganized account, company, integration, notification, and agent settings.
  • Improved content-access filters and layouts for long selections.
  • Simplified Secrets scan cards and workbench results by removing unsupported criticality and validity indicators.
  • Kept GitHub and GitLab pull request comments anchored only to valid changed lines.
  • Improved scan throughput and recovery by processing multiple scans concurrently and reclaiming interrupted work safely.
  • Corrected scheduled scan dates and last-run times for the configured day and timezone.
  • Fixed SAML sign-in so eligible first-time users can be provisioned through their identity provider when self-service registration is disabled.
  • Improved Azure DevOps pull request processing for permission-denied responses.
  • Prevented active legacy scans from being automatically requeued or marked as failed.
  • Improved Advanced Search with pagination and caching for large result sets, allowing CSV exports beyond 30,000 findings.
  • Kept the selected Scan Logs tab in place while active scans refresh.
  • Required meaningful justifications for false-positive and accepted-risk decisions, with feedback when more detail is needed.
  • Ensured findings with missing metadata and dependency views with usage analysis continue to load reliably.