How visa/visa-vulnerability-agentic-harness works
VVAH is an LLM-powered vulnerability discovery harness whose main workflow scans a repository, models threats, investigates and verifies findings, then synthesizes Markdown/SARIF reports. Optional branches verify exploits over HTTP, replay confirmed attacks, and propose and validate fixes. The graph preserves the README’s documented stages and major capabilities; several subsystem links reflect README-level workflow because their implementation was not sampled.
Main entry points: registry.py LLM Registry · router.py Exploit Verification · scan.py Scan Orchestrator · s3_decompose.py Discovery S1–S3
Components 26
Scan Workflow
- CLI
vvaharness/cli.py - Scan Orchestrator
vvaharness/orchestrator/scan.py - Static Seed
vvaharness/pipeline/stages/s0_seed.py - Discovery S1–S3
vvaharness/pipeline/stages/s3_decompose.py - Synthesis S7–S9
vvaharness/pipeline/stages/s8_chain.py - Portfolio Scans
vvaharness/orchestrator/batch.py
Analysis and Verification
- Deep Dive S4
vvaharness/pipeline/stages/s4_deepdive.py - Call Graph
vvaharness/pipeline/stages/callgraph_engine/_scan.py - Static Verification S6
vvaharness/pipeline/stages/s6_verify.py - Exploit Verification
vvaharness/exploit_verification/verify/router.py - Exploit Replay
vvaharness/exploit_verification/replay/run.py
Model Backends
- Backend Routing
vvaharness/backends/harness/provider_routing.py - LLM Registry
vvaharness/backends/llm/registry.py - CLI LLM
vvaharness/backends/llm/cli.py - SDK LLM
vvaharness/backends/llm/sdk.py - DeepAgents LLM
vvaharness/backends/llm/deepagents.py
Triage and Fixes
- Report Enrichment
vvaharness/report/enrich.py - Report Redaction
vvaharness/report/redact.py - Remediation
vvaharness/remediation_agent/remediate.py - Fix Validation
vvaharness/validation/execution/pipeline.py
Configuration and Runtime
- EV Settings
vvaharness/exploit_verification/settings.py - Configuration
vvaharness/config/__init__.py - Token Accounting
vvaharness/util/tokens.py - Run Counters
vvaharness/util/counters.py - Run State
vvaharness/orchestrator/store.py
Other components
- Operator
Connections 25
- Operator → CLI: invokes
- CLI → Scan Orchestrator: starts scan
- Scan Orchestrator → Static Seed: runs stages
- Static Seed → Discovery S1–S3: seeds analysis
- Discovery S1–S3 → Deep Dive S4: feeds review
- Discovery S1–S3 → Call Graph: uses reachable-code analysis
vvaharness/pipeline/stages/s3_decompose.py - Deep Dive S4 → Static Verification S6: submits findings
- Static Verification S6 → Exploit Verification: optionally verifies
vvaharness/exploit_verification/verify/router.py - EV Settings → Exploit Verification: configures
vvaharness/exploit_verification/settings.py - Exploit Verification → Exploit Replay: enables replay
- Static Verification S6 → Synthesis S7–S9: passes findings
- Synthesis S7–S9 → Report Enrichment: emits findings
- Report Enrichment → Report Redaction: redacts output
vvaharness/report/redact.py - Report Enrichment → Remediation: supports fix proposals
- Remediation → Fix Validation: proposes validation
- Scan Orchestrator → Backend Routing: routes model roles
- Backend Routing → LLM Registry: resolves provider
vvaharness/backends/harness/provider_routing.py - LLM Registry → CLI LLM: selects route
vvaharness/backends/llm/registry.py - LLM Registry → SDK LLM: selects route
- LLM Registry → DeepAgents LLM: selects route
vvaharness/backends/llm/deepagents.py - Configuration → Backend Routing: provides settings
vvaharness/backends/harness/provider_routing.py - Exploit Verification → Token Accounting: accounts usage
vvaharness/exploit_verification/verify/router.py - DeepAgents LLM → Run Counters: records fallback
vvaharness/backends/llm/deepagents.py - Operator → Portfolio Scans: starts batch
- Portfolio Scans → Run State: persists run state