mirror of
https://github.com/hanzoai/mcp.git
synced 2026-11-02 00:44:04 +00:00
zeekay
56a2b02dcf
kai_next_action never returns a candidate whose preconditions are unmet, returns a single remaining one as is, and picks among several by BM25 against the goal, abstaining on a tie or no shared word; no Kai call (a Kai choice over candidates read below BM25 for tools). kai_recover maps each kai_log_triage class to a step (permission asks the user) and keeps the three-failure switch. kai_extract computes a yes/no field's confidence from P(true), abstains in Kai's unknown band (.35 to .65), and returns a score field's level rather than its mean. Recipes 02, 06, 07, 11, 12 and 14 check what the tools return, including abstention; the cookbook README and the tools' comments link the research runs instead of quoting numbers. bench/tools/post.py files each tool's read (benchmarks, one run an arm, items and cases as artifacts) to /v1/research.
71 lines
2.3 KiB
TypeScript
71 lines
2.3 KiB
TypeScript
/**
|
|
* Recipe 14: Dependency Audit Triage
|
|
*
|
|
* Objective: Triage vulnerability alert outputs (e.g. from cargo audit or npm audit)
|
|
* into actionable severity tiers and select appropriate remediation strategies.
|
|
*/
|
|
|
|
import { createRecipeClient, logRecipe, RecipeResult } from "./helper.js";
|
|
|
|
export async function runRecipe14(): Promise<RecipeResult> {
|
|
const client = await createRecipeClient();
|
|
|
|
const auditOutput = `
|
|
Crate: openssl
|
|
Version: 0.10.38
|
|
Warning: RUSTSEC-2023-0044: Memory corruption in OpenSSL X.509 certificate verification
|
|
Severity: critical (CVSS 9.8)
|
|
Solution: Upgrade to >= 0.10.55
|
|
Dependency tree:
|
|
auth-service v0.1.0
|
|
└── openssl v0.10.38
|
|
`;
|
|
|
|
const res = await client.callTool("kai_extract", {
|
|
text: auditOutput,
|
|
schema: {
|
|
package_name: {
|
|
type: "choice",
|
|
description: "Vulnerable package identified in report",
|
|
options: ["openssl", "tokio", "serde", "reqwest"]
|
|
},
|
|
severity_tier: {
|
|
type: "score",
|
|
description: "Vulnerability severity level",
|
|
levels: ["low", "moderate", "high", "critical"]
|
|
},
|
|
actionable_fix: {
|
|
type: "choice",
|
|
description: "Recommended remediation action",
|
|
options: [
|
|
"update_cargo_toml_version",
|
|
"ignore_advisory_in_audit_config",
|
|
"vendor_patched_source",
|
|
"rearchitect_to_remove_dependency"
|
|
]
|
|
}
|
|
}
|
|
});
|
|
|
|
const extracted = res.data.extracted;
|
|
// A field counts when it is right or abstains: the caller acts only on fields that do not abstain.
|
|
const rightOrAbstained = (f: any, ok: unknown[]) => f.abstained || ok.includes(f.value);
|
|
const success = rightOrAbstained(extracted.package_name, ["openssl"]) &&
|
|
rightOrAbstained(extracted.actionable_fix, ["update_cargo_toml_version", "vendor_patched_source"]);
|
|
|
|
const result: RecipeResult = {
|
|
recipe: "14: Dependency Audit Triage",
|
|
tool: "kai_extract",
|
|
success,
|
|
latency_ms: res.latency_ms,
|
|
output: res.data,
|
|
explanation: "Each field comes back with its confidence; one near uniform abstains rather than guess. Act only on fields that do not abstain."
|
|
};
|
|
|
|
return result;
|
|
}
|
|
|
|
if (process.argv[1]?.endsWith("14-dependency-audit-triage.ts")) {
|
|
runRecipe14().then(logRecipe).catch(console.error);
|
|
}
|