Does This CVE Affect Me? I Built an AI Agent That Shows Its Evidence

Description and use

A developer built a local tool that verifies whether a specific CVE applies to an npm package version, returning evidence, fixes, and source links.

Problem

Developers need a way to verify if a specific CVE applies to a package version and see evidence and fixes.

Outcome

The assistant provides a concise, evidence‑backed answer with links to original advisories, enabling developers to verify CVE applicability quickly.

Workflow

• Enter package name, optional version, and CVE question on the Research page
• Run research to query OSV and the Sanity Knowledge Base
• Review the overview for affected ranges and fixes
• Check the Coverage tab to confirm all sources completed
• Inspect the Sources tab for original advisory links
• Review the Activity tab for operation details
• Upload a package‑lock.json to the Dependencies tab
• View exact dependency matches and advisory links

Evidence

I built AI Security Advisory Assistant, an evidence-first tool for researching known vulnerabilities in npm packages.

Source

The app returns documented affected ranges, source-listed fixes, deployment conditions to verify, and links to original advisories.

Source

The Coverage tab records the resolved npm package, how many live advisories were retrieved and matched, whether the Knowledge Base check completed, and the timing of each source.

Source

The app parses the JSON as data; it does not install packages or run scripts.

Source