Evidence-Backed Vulnerability Investigator
Streamlit prototype that matches vulnerability scanner findings against local advisory evidence and asks Claude for a structured, evidence-grounded disposition recommendation.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
Evidence-Backed Vulnerability Investigator Builder Interview
Get your own builder interview.Book a spot →
For AI agents: this listing as JSON or Markdown. It is one of 140 listings in the full index.
Evidence-Backed Vulnerability Investigator is a local Streamlit prototype that helps a security analyst investigate vulnerability scanner findings. It compares each finding against local Markdown vendor advisories, then asks Claude for a structured, evidence-grounded disposition recommendation — the analyst always makes the final call.
What it does
Loads findings from CSV/JSON (or bundled samples), deterministically matches them against local advisory evidence (exact CVE/plugin-ID match, product/vendor/version overlap, keyword scoring — no embeddings), and calls Claude to recommend one of four dispositions: REMEDIATE, RECAST_MITIGATED, RECAST_FALSE_POSITIVE, or MANUAL_REVIEW. The analyst reviews, approves/rejects/overrides the recommendation, then saves and exports the investigation (JSON/Markdown).
How it works
A thin Streamlit UI sits over independently unit-tested, pure-Python modules (config, findings, advisories, matching, prompts, claude_client, investigations, storage, exports). Evidence matching is deterministic keyword/identifier scoring, not semantic retrieval, so every match is explainable. The Anthropic API is called only when the analyst explicitly clicks “Investigate with Claude”; API keys are never logged, displayed, or written to saved results. This is a single-user, local-only, human-in-the-loop tool — it never writes back to a scanner or production system.