Plumbline: A Graph-Powered Agent for Supply-Chain Incident Response

说明与用途

Plumbline 利用 FalkorDB 图数据库自动分析 npm lockfile 依赖，提供确定性的 EXPOSED、CLEARED 或 UNKNOWN 判定，并附带证据和哈希收据，同时跟踪事实变更并自动重新开启受影响的决策。

问题

During a software supply‑chain incident, teams need to know which services are affected by a poisoned package and how the malicious version propagates through dependencies, rather than just whether a package is vulnerable.

结果

Plumbline provides deterministic, evidence‑backed verdicts, transparent receipts, and decision memory that automatically reopens affected approvals when new evidence arrives, improving incident response accuracy and reproducibility.

工作流

• 1. Upload an npm lockfile to the lockfile checker, creating an isolated FalkorDB graph.
• 2. Plumbline queries the graph to find repositories that lock affected package versions.
• 3. It computes the shortest dependency path from the service to the malicious package.
• 4. The deterministic verdict policy assigns EXPOSED, CLEARED, or UNKNOWN based on evidence and assumptions.
• 5. A receipt containing the verdict, evidence, path, assumptions, and policy version is generated and hashed.
• 6. Decision memory links approvals to the facts they assume; when a fact changes, only affected decisions reopen.
• 7. The MCP server exposes tools for triage, path explanation, fix ranking, and task queue management.
• 8. Users review receipts, inspect paths, and approve decisions via the UI.

证据

Plumbline is an open‑source supply‑chain triage agent. It follows dependency paths in FalkorDB, produces evidence-backed EXPOSED, CLEARED, or UNKNOWN verdicts, remembers the assumptions behind human decisions, and reopens only the decisions affected by new evidence.

来源

Plumbline produces one of three verdicts: EXPOSED, CLEARED, or UNKNOWN.

来源

Each verdict has a receipt containing the verdict, evidence, dependency path, assumptions, and policy version. The receipt is hashed and can be re‑derived from the graph.

来源