{"id":26896964,"url":"https://github.com/alexdevassy/AI-Powered-Vulnerability-Impact-Analyzer","last_synced_at":"2025-04-01T04:02:33.060Z","repository":{"id":278104822,"uuid":"934534226","full_name":"alexdevassy/AI-Powered-Vulnerability-Impact-Analyzer","owner":"alexdevassy","description":"Vulnerability impact analyzer that reduces false positives in SCA tools by performing intelligent code analysis. Uses agentic AI with open source models to understand CVEs and verify actual vulnerability impact in your codebase. Keeps your code secure with on-premises execution and human-in-the-loop verification.","archived":false,"fork":false,"pushed_at":"2025-02-18T02:05:11.000Z","size":778,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-18T03:01:45.086Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alexdevassy.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-18T01:56:49.000Z","updated_at":"2025-02-18T02:05:14.000Z","dependencies_parsed_at":"2025-02-18T03:01:48.063Z","dependency_job_id":"e02b08e4-6070-4efa-aaf3-4f05b268fd2e","html_url":"https://github.com/alexdevassy/AI-Powered-Vulnerability-Impact-Analyzer","commit_stats":null,"previous_names":["alexdevassy/ai-powered-vulnerability-impact-analyzer"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alexdevassy","download_url":"https://codeload.github.com/alexdevassy/AI-Powered-Vulnerability-Impact-Analyzer/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246580468,"owners_count":20800111,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-01T04:02:25.472Z","updated_at":"2025-04-01T04:02:33.048Z","avatar_url":"https://github.com/alexdevassy.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# AI-Powered Vulnerability Impact Analyzer 🔍\n\n\u003e 🤖 Where AI meets Security to tell you if you *really* need to panic about that CVE\n\n## 🌟 Introduction\nTraditional Software Composition Analysis (SCA) tools often generate excessive false positives by solely relying on Software Bill of Materials (SBOM) for vulnerability detection. This tool supercharges the SCA process by performing intelligent impact analysis on reported vulnerabilities.\n\nUsing agentic AI powered by the open-source Mistral model, it:\n- 📚 Analyzes CVE descriptions of vulnerable packages to pinpoint the components that cause vulnerability.\n- 👮 Human-in-the-loop model to ensure  accuracy and control\n- 🔍 Searches your codebase for these components\n- 🎯 Performs deep code analysis to verify actual vulnerability impact\n- 💡 Reduces false positives by understanding context\n- 🔒 Keeps your code secure with a fully on-premises AI solution—no data leaves your premises.\n\n### 🧠 How It Works\nThe tool implements a multi-agent AI system where specialized agents work together:\n1. `GithubAdvisoryTool`: Fetches and parses CVE information\n2. `SecurityAnalystAgent`: Uses Mistral to identify vulnerable components from the CVE description\n3. `ComponentSearcherTool`: Scans codebase for identified components\n4. `CodeReviewerAgent`: Analyzes code patterns for actual vulnerability impact\n\n### 🏗️ Architecture\n\n\u003ckbd\u003e![Alt text](images/arch_diagram.png?raw=true \"architecture_diagram\")\u003c/kbd\u003e\n\n### 📦 Prerequisites\n- Python 3.12.3\n- GitHub API token\n- Ollama installed and running locally with Mistral 7B model\n\n   ```bash\n   ollama pull mistral\n   ```\n- GPU with CUDA installed\n\n### 🛠️ Installation \u0026 Setup\n1. Clone the repository\n2. Create a `.env` file in the project root:\n\n   ```\n   GITHUB_TOKEN=your_github_token_here\n   ```\n3. Ensure Ollama is running with the Mistral model:\n4. Install the required packages:\n   ```bash\n   pip install -r requirements.txt\n   ```  \n\n### 🚀 Usage\n\nRun the tool by providing a GitHub Advisory ID (GHSA ID) and the path to your codebase:\n   ```bash\n   python3 cve_analyzer.py \u003cGHSA ID\u003e \u003cpath_to_codebase\u003e\n   ``` \n### 🎥 Demo\n\nThe demo showcases vulnerabilities (GHSA ID) from SBOM / Github Dependabot alerts are analyzed by the tool and the impact is studied. The code repo used in the demo for analysis and SBOM generation is [Dolos AI CTF Challenge](https://github.com/alexdevassy/Machine_Learning_CTF_Challenges/tree/master/Dolos_ML_CTF_Challenge).\n\n\u003ckbd\u003e![Alt text](images/cve_analyzer.gif?raw=true \"demo\")\u003c/kbd\u003e\n\n### ⚠️ Limitations\n- Currently tested on Python codebases\n- Vector DB is not used for now but will be used in the future to store and retrieve codebase and CVE information \n- Only CVE description is used for now, but it will be extended to use more sources of information in the future such as CVE exploit POCs\n\n### 🤝 Contributing\nContributions are welcome! Please feel free to submit a Pull Request.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falexdevassy%2FAI-Powered-Vulnerability-Impact-Analyzer/lists"}