# ondrej-polak/llm-rag-vuln-triage architecture

> Architecture diagram of the GitHub repository ondrej-polak/llm-rag-vuln-triage, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ondrej-polak/llm-rag-vuln-triage
- Repository: https://github.com/ondrej-polak/llm-rag-vuln-triage
- Video tour (about a minute): https://gitdiagram.com/ondrej-polak/llm-rag-vuln-triage/video

## Overview

The product is a local vulnerability-assessment assistant: users upload Nmap XML, review parsed services, and request an evidence-linked triage report. The app parses and formats scan findings, enriches application CPEs with NVD CVEs tagged against CISA KEV, stores both evidence types in Chroma, then retrieves evidence for a local-LLM assessment and report export. The graph reflects the sampled app and runtime modules; the README is empty, and unsampled module details and deployment wiring are omitted.

Main entry points: [`app.py`](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py) (Scan orchestration), [`rag.py`](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py) (RAG chain), [`nvd.py`](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/nvd.py) (CVE enrichment), [`kev.py`](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/kev.py) (KEV index)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interaction["User workflow"]
  node_app_ui["Streamlit interface<br/>[app.py]"]
  node_app_flow["Scan orchestration<br/>[app.py]"]
  node_report["Assessment and export<br/>[app.py]"]
end

subgraph group_enrichment["Finding enrichment"]
  node_parser["XML parser<br/>[parser.py]"]
  node_formatter["Finding formatter<br/>[parser.py]"]
  node_kev_index["KEV index<br/>[kev.py]"]
  node_kev_cache[("KEV cache<br/>[kev.py]")]
  node_nvd_enrich["CVE enrichment<br/>[nvd.py]"]
end

subgraph group_evidence["Evidence storage"]
  node_chroma[("Chroma collection<br/>[app.py]")]
  node_embedder["Ollama embeddings<br/>[app.py]"]
end

subgraph group_analysis["Triage analysis"]
  node_rag["RAG chain<br/>[rag.py]"]
  node_retriever["Evidence retriever<br/>[rag.py]"]
  node_prompt["Triage prompt<br/>[rag.py]"]
end

node_user(("Scan user"))
node_nmap["Nmap XML"]
node_cisa["CISA catalogue"]
node_nvd_api["NVD API"]
node_llm["Ollama LLM"]

node_user -->|"uploads scan"| node_app_ui
node_nmap -->|"provides XML"| node_app_ui
node_app_ui -->|"starts processing"| node_app_flow
node_app_flow -->|"parses XML"| node_parser
node_parser -->|"returns hosts"| node_formatter
node_app_flow -->|"formats findings"| node_formatter
node_app_ui -->|"loads catalogue"| node_kev_index
node_kev_index -->|"reads or writes"| node_kev_cache
node_kev_index -.->|"downloads catalogue"| node_cisa
node_app_flow -->|"enriches hosts"| node_nvd_enrich
node_nvd_enrich -->|"checks CVE status"| node_kev_index
node_nvd_enrich -->|"queries CVEs"| node_nvd_api
node_nvd_enrich -->|"returns CVE chunks"| node_app_flow
node_app_flow -->|"requests embeddings"| node_embedder
node_app_flow -->|"upserts evidence"| node_chroma
node_embedder -->|"embeds documents"| node_chroma
node_app_flow -->|"builds analysis"| node_rag
node_rag -->|"creates retriever"| node_chroma
node_rag -->|"configures retrieval"| node_retriever
node_rag -->|"assembles chain"| node_prompt
node_rag -->|"invokes model"| node_llm
node_app_ui -->|"invokes chain"| node_rag
node_app_ui -->|"fetches evidence"| node_retriever
node_retriever -->|"searches evidence"| node_chroma
node_app_ui -->|"renders and exports"| node_report
node_user -->|"views or downloads"| node_report

click node_app_ui "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py"
click node_app_flow "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py"
click node_report "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py"
click node_parser "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/parser.py"
click node_formatter "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/parser.py"
click node_kev_index "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/kev.py"
click node_kev_cache "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/kev.py"
click node_nvd_enrich "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/nvd.py"
click node_chroma "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py"
click node_embedder "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py"
click node_rag "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py"
click node_retriever "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py"
click node_prompt "https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app_ui,node_app_flow,node_report,node_user toneBlue
class node_parser,node_formatter,node_kev_index,node_kev_cache,node_nvd_enrich toneAmber
class node_chroma,node_embedder,node_nvd_api toneMint
class node_rag,node_retriever,node_prompt toneRose
class node_nmap,node_cisa,node_llm toneIndigo
```

## Components

### User workflow

- [Streamlit interface](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py): `app.py`
- [Scan orchestration](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py): `app.py`
- [Assessment and export](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py): `app.py`

### Finding enrichment

- [XML parser](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/parser.py): `parser.py`
- [Finding formatter](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/parser.py): `parser.py`
- [KEV index](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/kev.py): `kev.py`
- [KEV cache](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/kev.py): `kev.py`
- [CVE enrichment](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/nvd.py): `nvd.py`

### Evidence storage

- [Chroma collection](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py): `app.py`
- [Ollama embeddings](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/app.py): `app.py`

### Triage analysis

- [RAG chain](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py): `rag.py`
- [Evidence retriever](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py): `rag.py`
- [Triage prompt](https://github.com/ondrej-polak/llm-rag-vuln-triage/blob/main/rag.py): `rag.py`

### Other components

- **Scan user**
- **Nmap XML**
- **CISA catalogue**
- **NVD API**
- **Ollama LLM**

## Connections

- Scan user → Streamlit interface: uploads scan
- Nmap XML → Streamlit interface: provides XML
- Streamlit interface → Scan orchestration: starts processing
- Scan orchestration → XML parser: parses XML
- XML parser → Finding formatter: returns hosts
- Scan orchestration → Finding formatter: formats findings
- Streamlit interface → KEV index: loads catalogue
- KEV index → KEV cache: reads or writes
- KEV index → CISA catalogue: downloads catalogue
- Scan orchestration → CVE enrichment: enriches hosts
- CVE enrichment → KEV index: checks CVE status
- CVE enrichment → NVD API: queries CVEs
- CVE enrichment → Scan orchestration: returns CVE chunks
- Scan orchestration → Ollama embeddings: requests embeddings
- Scan orchestration → Chroma collection: upserts evidence
- Ollama embeddings → Chroma collection: embeds documents
- Scan orchestration → RAG chain: builds analysis
- RAG chain → Chroma collection: creates retriever
- RAG chain → Evidence retriever: configures retrieval
- RAG chain → Triage prompt: assembles chain
- RAG chain → Ollama LLM: invokes model
- Streamlit interface → RAG chain: invokes chain
- Streamlit interface → Evidence retriever: fetches evidence
- Evidence retriever → Chroma collection: searches evidence
- Streamlit interface → Assessment and export: renders and exports
- Scan user → Assessment and export: views or downloads