---
title: "ai.oz0/cve-triage"
description: "Known vulnerabilities from OSV in a checkout's locked dependencies, ranked, with ticket drafts; offline with a mirror."
canonical_url: "https://docs.oz0.ai/build/plugins/verified/cve-triage"
---
# ai.oz0/cve-triage

> Known vulnerabilities from OSV in a checkout's locked dependencies, ranked, with ticket drafts; offline with a mirror.

For: tenant administrators and plugin users.

`ai.oz0/cve-triage` scans lockfiles in a repository checkout on the node and looks up each pinned package in [OSV](https://osv.dev). Its `oz0-cve-triage` agent ranks the findings and drafts tickets for issues worth fixing.

The plugin only reads the checkout. It executes no checkout code and creates no tickets.

<table>
<thead>
  <tr>
    <th>
      Function
    </th>
    
    <th>
      What it does
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        oz0_cve_triage.scan_dependencies
      </code>
    </td>
    
    <td>
      <code>
        path
      </code>
      
      , <code>
        mirror
      </code>
      
      , <code>
        include_dev
      </code>
      
      . Reads go.mod, uv.lock, poetry.lock, Pipfile.lock, requirements*.txt, package-lock.json and yarn.lock (skipping node_modules, .venv, vendor and .git), and returns each advisory that affects a package, ranked
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        oz0_cve_triage.osv_query
      </code>
    </td>
    
    <td>
      <code>
        ecosystem
      </code>
      
       (Go, PyPI, npm), <code>
        name
      </code>
      
      , <code>
        version
      </code>
      
      , <code>
        mirror
      </code>
      
      : one package's advisories
    </td>
  </tr>
</tbody>
</table>

A finding's rank is its advisory's base score (CVSS v3 when the record has a vector, else its database's label), then
direct dependencies, which the project upgrades itself, and those with a fixed version. Versions are compared as each
ecosystem compares them (PEP 440 for PyPI, semantic versions for Go and npm), with the OSV schema's range rules.

## Install

Its agent `oz0-cve-triage` asks for the tenant's `default` [model alias](https://docs.oz0.ai/spend/models-and-keys/aliases#the-standard-aliases) with tools, never a vendor's model, so it runs on whichever provider the tenant set up first; map it elsewhere with `oz0 model alias set default <provider>/<model>`.

```bash [Terminal]
oz0 plugin install hub:ai.oz0/cve-triage
oz0 run oz0-cve-triage "Triage the dependencies of /srv/checkouts/shop"
```

## Online or offline

Without a mirror the plugin asks `api.osv.dev`, which its egress list names. With one, nothing leaves the node.
Its settings are [settings](https://docs.oz0.ai/admin/secrets/settings#settings-are-not-secrets) of the tenant, not secrets (version 1.0.0 read
them as optional secrets; with 1.1.0 old secrets of these names become settings by themselves):

<table>
<thead>
  <tr>
    <th>
      Setting
    </th>
    
    <th>
      Value
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        CVE_TRIAGE_OSV_MIRROR
      </code>
    </td>
    
    <td>
      A mirrored advisory file or folder on the nodes: OSV's <code>
        all.zip
      </code>
      
       per ecosystem (<a href="https://google.github.io/osv.dev/data/" rel="nofollow">
        bulk data
      </a>
      
      ), a folder of <code>
        .json
      </code>
      
       records, a <code>
        .json
      </code>
      
       or a <code>
        .jsonl
      </code>
      
       file
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        CVE_TRIAGE_OSV_OFFLINE
      </code>
    </td>
    
    <td>
      <code>
        true
      </code>
      
       (or <code>
        1
      </code>
      
      ) refuses the API when no mirror is given
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        CVE_TRIAGE_OSV_API_URL
      </code>
    </td>
    
    <td>
      Another OSV API than <code>
        https://api.osv.dev
      </code>
      
      , such as a mirror server of your own (it must be on the egress allowlist)
    </td>
  </tr>
</tbody>
</table>

```bash [Terminal]
oz0 setting set CVE_TRIAGE_OSV_MIRROR /srv/osv/PyPI-all.zip
oz0 setting set CVE_TRIAGE_OSV_OFFLINE true
```

A request may name a mirror too ("... with the advisories in /srv/osv"); the agent passes it as `mirror`.


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.