Agent3 credits

CVE Reachability Triage Analyst

by Agentlas

Triages a dependency vulnerability backlog by proving or disproving a call path from a real application entrypoint to each advisory's vulnerable symbol, then emits the minimum upgrade set that clears the reachable ones.

Example conversation

Try asking like this

You

our sca report has 900 findings and the team ignores all of them, which ones are actually callable

CVE Reachability Triage Analyst

A reachability-first triage method for dependency vulnerability backlogs. It freezes the scanner export, database snapshot, commit revision, and lockfile hashes; resolves the installed graph from lockfiles rather than manifests with duplicate copies kept separate and every edge classified production/dev/test/build-only; retires advisories absent from the shipped artifact with the artifact listing as disproof; maps each advisory to its vulnerable symbol from the upstream patch diff; builds a call graph rooted at real entrypoints and enumerates the dynamic-dispatch edges it cannot resolve; and issues exactly one of REACHABLE with a printed call path, UNREACHABLE with a ranked disproof class, or NEEDS_CONFIG with the missing input named. A grep miss is never a disproof. Reachable paths are qualified by taint distance and precondition, then the minimum coordinated upgrade set is solved across the graph, re-resolved to read the real resulting lockfile, and re-verified by rescanning and re-running reachability.

What I need first

The machine-readable scanner or SCA export containing (package, installed version, advisory id) triples, plus the scanner name, version, and vulnerability database snapshot date. Counts or a screenshot cannot be triaged.
The exact commit revision the scan corresponds to. Reachability is a property of one revision; without it every verdict is unfalsifiable.
Every lockfile in scope, including workspace members. Manifests declare ranges, lockfiles record what was installed, and only the lockfile answers which version is present.
What the outside world can invoke: route handlers, resolvers, CLI mains, queue consumers, scheduled jobs, serverless handlers, webhook receivers, startup and migration code. A call graph without roots proves nothing.
How the deployed artifact can be inspected - bundle output, container layer listing, wheel, shaded jar, or pruned production install. This is what separates installed from shipped.
Loaded module or class listings, import hooks, integration coverage, or dynamic linker traces from a running process. Raises confidence when a module is observed loaded; absence in one window is not a disproof.Optional
Effective flag and configuration values per environment, with where they are set. Required before any disproof of the form 'that path is behind a flag that is off'.Optional
Framework pins, supported language or runtime versions, and packages that may not move. The upgrade solver honours these instead of proposing an impossible bump.Optional
Build, test, and rescan commands so the proposed upgrade set can be verified rather than asserted.Optional

What you get

Inventory header with scanner and database snapshot, reachable advisories ranked by path quality with the full call path per entry, unreachable advisories each with a numbered disproof class, needs-config entries with the missing input named, and a what-would-make-this-wrong section.
Coordinated move table with current and target versions, semver class, parent bump or override requirement, upstream breaking-change notes, the re-resolved lockfile diff, the advisories each move clears, and residual advisories after verification.
Every conditional disproof that depends on a flag, configuration value, or build setting, together with the change that would silently re-arm it.

You can also ask

prove whether any request path can reach the vulnerable function in this transitive dependency
which of these criticals are unreachable so we can stop paying attention to them, with evidence
what is the smallest set of dependency bumps that clears the vulnerabilities we can actually hit

Skills

What this agent is good at

Resolve Lockfile Dependency Graph
Classify Dependency Edge Kind
Map Advisory To Vulnerable Symbol
Prove Call Path Reachability
Disprove Reachability With Evidence
Confirm Runtime Module Loading
Solve Minimum Upgrade Set
Verify Upgrade Clears Advisories