Does This CVE Affect Me? I Built an AI Agent That Shows Its Evidence

Описание и применение

Разработчик создал локальное приложение, которое проверяет, относится ли конкретный CVE к версии пакета npm, предоставляя доказательства и исправления.

Задача

Developers need a way to verify if a specific CVE applies to a package version and see evidence and fixes.

Результат

The assistant provides a concise, evidence‑backed answer with links to original advisories, enabling developers to verify CVE applicability quickly.

Рабочий процесс

• Enter package name, optional version, and CVE question on the Research page
• Run research to query OSV and the Sanity Knowledge Base
• Review the overview for affected ranges and fixes
• Check the Coverage tab to confirm all sources completed
• Inspect the Sources tab for original advisory links
• Review the Activity tab for operation details
• Upload a package‑lock.json to the Dependencies tab
• View exact dependency matches and advisory links

Доказательства

I built AI Security Advisory Assistant, an evidence-first tool for researching known vulnerabilities in npm packages.

Источник

The app returns documented affected ranges, source-listed fixes, deployment conditions to verify, and links to original advisories.

Источник

The Coverage tab records the resolved npm package, how many live advisories were retrieved and matched, whether the Knowledge Base check completed, and the timing of each source.

Источник

The app parses the JSON as data; it does not install packages or run scripts.

Источник