visa-vulnerability-agentic-harness

Why we included this project

This one is worth a look if your team spends more time triaging scanner output than fixing real bugs. Instead of stopping at a list of suspicious lines, it runs an eleven-stage pipeline that maps the attack surface, models the threats, checks reachable paths, and tries to confirm whether a finding is actually exploitable before a human ever sees it. Multi-agent voting and the structured SARIF/CVSS output exist to cut false positives, the usual reason AI scanners get ignored. It also goes past detection: it proposes candidate fixes and validates them, so the workflow can end with a patch instead of another ticket. One caveat worth knowing: the default profile edits source files in fix mode, and the findings are LLM-generated triage candidates that still need human review, so treat it as a force multiplier for an existing AppSec process, not a replacement.