# Evidence-Backed Vulnerability Investigator

> Streamlit prototype that matches vulnerability scanner findings against local advisory evidence and asks Claude for a structured, evidence-grounded disposition recommendation.

- Type: Agent
- Author: infosecloudninja007
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-08-05
- Source repository: https://github.com/infosecloudninja007/evidence-vulnerability-investigator
- Repo state: not archived
- Last push: 2026-08-05T20:17:07Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Anthropic
- Domains: vulnerability-management
- Tags: vulnerability-management, streamlit, claude, evidence-based, security-analyst-workflow, disposition-triage
- Date added: 2026-08-05
- Listing page: https://exchange.tenable.com/agents/evidence-backed-vulnerability-investigator
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/agents/evidence-backed-vulnerability-investigator.md

Evidence-Backed Vulnerability Investigator is a local Streamlit prototype that helps a security analyst investigate vulnerability scanner findings. It compares each finding against local Markdown vendor advisories, then asks Claude for a structured, evidence-grounded disposition recommendation — the analyst always makes the final call.

## What it does

Loads findings from CSV/JSON (or bundled samples), deterministically matches them against local advisory evidence (exact CVE/plugin-ID match, product/vendor/version overlap, keyword scoring — no embeddings), and calls Claude to recommend one of four dispositions: REMEDIATE, RECAST_MITIGATED, RECAST_FALSE_POSITIVE, or MANUAL_REVIEW. The analyst reviews, approves/rejects/overrides the recommendation, then saves and exports the investigation (JSON/Markdown).

## How it works

A thin Streamlit UI sits over independently unit-tested, pure-Python modules (config, findings, advisories, matching, prompts, claude_client, investigations, storage, exports). Evidence matching is deterministic keyword/identifier scoring, not semantic retrieval, so every match is explainable. The Anthropic API is called only when the analyst explicitly clicks "Investigate with Claude"; API keys are never logged, displayed, or written to saved results. This is a single-user, local-only, human-in-the-loop tool — it never writes back to a scanner or production system.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/agents/evidence-backed-vulnerability-investigator.json. The full index and how to read it: https://exchange.tenable.com/llms.txt