Runtime Agent

Know which dependencies actually run in production. Prioritize real risk.

Zero overhead

Under 1ms latency impact. Daemon timer, no blocking.

Zero dependencies

No transitive risk. Pure stdlib implementation.

Runtime truth

Know which CVEs affect packages that actually load.

Prerequisites:You need a Sectora CI token. Go to Settings > Integrations > CI Tokens to create one.

Installation

Copy

npm install @sectora/agent

Quick Start

Add this to the very first line of your application entry point (before any other imports):

Copy

// app.js or index.js — MUST be the first line
require('@sectora/agent').init({
  apiKey: 'your-ci-token',
  projectName: 'my-app',
  endpoint: 'https://api.sectora.io/api/v1/ci/runtime/report',
})

ES Modules

Copy

// For ESM projects, create a loader file: sectora-loader.cjs
require('@sectora/agent').init({
  apiKey: process.env.SECTORA_CI_TOKEN,
  projectName: 'my-app',
  endpoint: 'https://api.sectora.io/api/v1/ci/runtime/report',
})

// Then start your app with:
// node -r ./sectora-loader.cjs app.js

Configuration

Option	Type	Default	Description
`apiKey`	string	required	Sectora CI token
`projectName`	string	required	Name shown in Sectora dashboard
`endpoint`	string	required	Sectora API endpoint URL
`environment`	string	'production'	Environment label (production, staging, etc.)
`reportInterval`	number	300000	Report interval in ms (default 5 min)
`debug`	boolean	false	Enable debug logging

Environment Variables

Instead of hardcoding config, use environment variables:

Copy

require('@sectora/agent').init({
  apiKey: process.env.SECTORA_CI_TOKEN,
  projectName: process.env.SECTORA_PROJECT || 'my-app',
  endpoint: process.env.SECTORA_ENDPOINT || 'https://api.sectora.io/api/v1/ci/runtime/report',
  environment: process.env.NODE_ENV || 'production',
})

Framework Examples

Express

Copy

// server.js
require('@sectora/agent').init({
  apiKey: process.env.SECTORA_CI_TOKEN,
  projectName: 'my-express-api',
  endpoint: 'https://api.sectora.io/api/v1/ci/runtime/report',
})

const express = require('express')
const app = express()
// ... rest of your app

Next.js

Copy

// instrumentation.js (Next.js 13+)
export async function register() {
  if (process.env.NEXT_RUNTIME === 'nodejs') {
    const { init } = require('@sectora/agent')
    init({
      apiKey: process.env.SECTORA_CI_TOKEN,
      projectName: 'my-nextjs-app',
      endpoint: 'https://api.sectora.io/api/v1/ci/runtime/report',
    })
  }
}

NestJS

Copy

// main.ts — add before NestFactory.create
import '@sectora/agent'
// In a separate file loaded first, or in main.ts before bootstrap:
require('@sectora/agent').init({
  apiKey: process.env.SECTORA_CI_TOKEN,
  projectName: 'my-nestjs-api',
  endpoint: 'https://api.sectora.io/api/v1/ci/runtime/report',
})

How It Works

Patches Node.js Module._load to intercept every require() call
Records package name + version from package.json for each loaded module
Reports loaded packages to Sectora every 5 minutes via HTTPS POST
Uses setInterval with unref() — will NOT keep your process alive
Graceful shutdown on SIGTERM/SIGINT

What Happens After Installation

1.
Agent starts tracking loaded packages immediately on application start
2.
Every 5 minutes, a report is sent to Sectora with the package list
3.
Sectora cross-references with your SCA scan results to identify vulnerable runtime packages
4.
The Runtime Dependencies page shows which packages are confirmed running in production
5.
Vulnerabilities in runtime packages are flagged as higher priority in the Security Posture dashboard