vulntriage

Published open sourcePublic package · v0.15.2

A Python CLI that enriches pip-audit findings with NVD, CISA KEV and EPSS signals, then uses a chosen LLM backend to produce a ranked first-pass fix list.

Problem

Raw severity can leave a developer with a long flat list and no useful first move. The tool needed to add threat context and likely-reachability reasoning without presenting an LLM heuristic as a proven call graph.

Implementation record

How I solved it

  1. 01

    Starts with pip-audit findings, then joins NVD severity, CISA KEV exploitation status and EPSS probability so the ranking has deterministic threat context before any model is involved.

  2. 02

    Keeps provider integrations behind one ranking boundary: an API provider, a subscription coding CLI and local Ollama can explain or order findings without replacing the authoritative NVD score.

  3. 03

    Treats release recovery as part of the work: after clean-install failures, the broken package releases were yanked, the packaging path was corrected and v0.15.2 was republished with the failure trail documented.

My role / what I owned

Open-source maintainer and package author

  • Built and published the Python package on top of pip-audit.
  • Integrated NVD, CISA KEV and EPSS, with authoritative NVD scores overriding model output.
  • Added API, subscription-CLI and local Ollama providers behind one ranking boundary.
  • Documented clean-install failures, yanked the broken releases and published the corrected v0.15.2 package.

How it was built

Team
An open-source project maintained in Nivish’s public repository.
Tools
  • Python
  • PyPI
  • pip-audit
  • NVD
  • CISA KEV
  • EPSS
  • LLM provider adapters
Use of AI
An LLM ranks and explains the enriched findings through API, coding-CLI or local Ollama providers. NVD severity remains authoritative, and likely reachability is labelled as heuristic rather than proven.

Source and current state

  • 27 public commits at the August 2026 review.
  • 14 direct test modules, plus fixtures and support files.
  • Published PyPI package at v0.15.2 and a public failure retrospective.
Status
The current public release is v0.15.2. Earlier broken releases were yanked after clean-install failures.
What it shows
The source, tests, package, provider boundaries and correction trail can all be inspected publicly.
Source repositoryOpens in a new tabPyPI v0.15.2Opens in a new tabFailure retrospectiveOpens in a new tab