How sparshladani/sast-agentic-triage-workflow works
This repository is a prototype SAST-finding triage workflow: scanner SARIF is normalized, findings are investigated with bounded read-only tools, verdicts are validated and recorded, and a cited Markdown report is produced for human review. The README documents the LangGraph flow and its capabilities; the notebook is present in the tree but was not excerpted, so its implementation details cannot be verified. The normalization stage is supported by normalize.py. Edges cite the README where documented; normalization behavior cites its source.
Main entry points: sast_triage.ipynb Investigate finding · normalize.py Normalize findings
Components 16
Finding ingestion
- Scanner SARIF
- Normalize findings
normalize.py - Finding JSON
Triage workflow
- Load state
sast_triage.ipynb - Select finding
sast_triage.ipynb - Investigate finding
sast_triage.ipynb - Route tool decision
sast_triage.ipynb - Finalize verdict
sast_triage.ipynb
Investigation controls
- Run read-only tools
sast_triage.ipynb
Review outputs
- Record and validate extras
sast_triage.ipynb - Build triage report
sast_triage.ipynb - Markdown report
Other components
- Semgrep / Bandit
- Analyst
- Target codebase
- Language model
Connections 23
- Semgrep / Bandit → Scanner SARIF: emit SARIF
README.md - Scanner SARIF → Normalize findings: read reports
normalize.py - Normalize findings → Finding JSON: write findings
normalize.py - Finding JSON → Load state: load input
README.md - Load state → Select finding: initialize state
README.md - Record and validate extras → Select finding: check remaining
README.md - Select finding → Investigate finding: findings remain
README.md - Select finding → Build triage report: none remain
README.md - Investigate finding → Language model: request analysis
README.md - Language model → Investigate finding: return response
README.md - Investigate finding → Route tool decision: route response
README.md - Route tool decision → Run read-only tools: tool call under cap
README.md - Run read-only tools → Target codebase: read code
README.md - Run read-only tools → Investigate finding: return tool output
README.md - Route tool decision → Finalize verdict: answer or cap reached
README.md - Finalize verdict → Language model: request verdict samples
README.md - Language model → Finalize verdict: return verdicts
README.md - Finalize verdict → Record and validate extras: record verdict
README.md - Build triage report → Language model: compose report
README.md - Language model → Build triage report: return report text
README.md - Build triage report → Markdown report: write report
README.md - Analyst → Finding JSON: provide scanner results
- Markdown report → Analyst: review findings