Evidence-Backed Vulnerability Investigator

Evidence-Backed Vulnerability Investigator is a local Streamlit prototype that helps a security analyst investigate vulnerability scanner findings. It compares each finding against local Markdown vendor advisories, then asks Claude for a structured, evidence-grounded disposition recommendation — the analyst always makes the final call.

What it does

Loads findings from CSV/JSON (or bundled samples), deterministically matches them against local advisory evidence (exact CVE/plugin-ID match, product/vendor/version overlap, keyword scoring — no embeddings), and calls Claude to recommend one of four dispositions: REMEDIATE, RECAST_MITIGATED, RECAST_FALSE_POSITIVE, or MANUAL_REVIEW. The analyst reviews, approves/rejects/overrides the recommendation, then saves and exports the investigation (JSON/Markdown).

How it works

A thin Streamlit UI sits over independently unit-tested, pure-Python modules (config, findings, advisories, matching, prompts, claude_client, investigations, storage, exports). Evidence matching is deterministic keyword/identifier scoring, not semantic retrieval, so every match is explainable. The Anthropic API is called only when the analyst explicitly clicks “Investigate with Claude”; API keys are never logged, displayed, or written to saved results. This is a single-user, local-only, human-in-the-loop tool — it never writes back to a scanner or production system.