AI Integration

Why It Matters

Security triage is high-cognitive-load, repetitive work. Every report requires scope checking, duplicate detection, severity assessment, and a response to the researcher. AI assistance reduces average triage time from hours to minutes.

The CSIRT AI agent can read your entire program state, suggest severity, check duplicates, and draft responses without leaving the context of your workflow. It operates as a copilot, not an autopilot — every write action requires your explicit confirmation before executing.

AI Screening (Automatic)

Every submitted report is scored automatically before it reaches your triage board. No configuration required — screening runs on every submission.

The screener detects five categories of AI slop signals:

Signal	What It Catches
Hallucinated function names	References to methods or APIs that do not exist in common frameworks or the target codebase
Fabricated CVE numbers	CVE IDs that do not appear in the NVD database, or commit hashes that do not resolve
Vague proof-of-concept	“I can demonstrate this on request” with no reproduction steps, screenshots, or runnable exploit
Template language	Copy-pasted structure from a bug bounty report template that could apply to any target
Em-dash heavy prose	Stylistic markers common in AI-generated content: uniform sentence length, excessive formatting, LLM vocabulary

Each report receives a confidence score (0–100) and a recommendation:

Recommendation	Meaning
Pass	No slop signals detected. Report enters the triage board normally.
Review	Mild signals present. Report enters the triage board with a warning badge.
Flag	Strong slop signals. Report is flagged on the triage board card with an AI badge and reasoning.

Flagged reports are never auto-rejected. The screening result and its reasoning are visible on the report detail view so you can make the final call. This is advisory only — the system is intentionally conservative to avoid falsely flagging legitimate researchers, especially non-native English speakers.

CSIRT AI Agent

Access the AI assistant via the sidebar chat (the chat icon in the top navigation). On VDP pages, the assistant automatically loads the CSIRT agent with full access to your program data.

The agent has access to 21 tools across two categories:

• Read tools (15) — query program state, reports, researchers, metrics, and financial data
• Write tools (6) — triage reports, record assessments, send messages, and approve bounties

Write tools require confirmation. The AI will describe what it is about to do and wait for your approval before executing.

Read Tools

Tool	What It Does
csirt_get_setup_guide	Program overview with report counts, SLA compliance percentage, and config completeness checklist
csirt_get_program	Full program configuration — all seven settings tabs rendered as human-readable data
csirt_list_reports	Filterable report list with SLA indicators (filter by status, severity, assignee, SLA status)
csirt_get_report	Full report detail: assessment, messages, timeline, bounty award, researcher profile
csirt_get_report_timeline	Chronological log of every event on a report (status transitions, messages, assessments, assignments)
csirt_check_duplicates	Finds candidate duplicates based on matching endpoint and vulnerability type
csirt_validate_scope	Checks if a report’s affected endpoint falls within the configured program scope
csirt_suggest_severity	Returns report context alongside the bounty matrix so the AI can reason about appropriate severity
csirt_get_bounty_benchmark	Historical bounty data for a severity tier or vulnerability type (median, average, range, recent examples)
csirt_list_messages	Full message thread for a report, including internal notes
csirt_draft_response	Loads the matching Liquid template with pre-filled variables so the AI can draft a natural researcher response. This is a read tool — it prepares context but does not send anything. Use csirt_send_message to send.
csirt_get_ledger	Financial audit trail, filterable by report, entry type, and date range
csirt_get_metrics	MTTA, MTTR, SLA compliance percentage, reports by severity and status, top researchers, total bounty data
csirt_get_researcher	Researcher profile with submission history, karma tier, and total bounty earned
csirt_list_researchers	Filterable researcher directory with report counts and bounty totals

Write Tools

Write tools require explicit confirmation before executing. The AI will tell you what it is about to do, and you must approve the action.

Tool	What It Does
csirt_triage_report	Advance a report’s status (e.g., Submitted to Triaged) with an optional comment
csirt_assess_report	Record a CVSS vector and severity assessment on a report
csirt_dismiss_report	Dismiss a report with a reason code (out of scope, duplicate, not reproducible, spam) and optional note
csirt_assign_report	Assign a report to a team member for investigation
csirt_send_message	Send a message in the report thread — external (visible to researcher) or internal (staff only)
csirt_approve_bounty	Approve a bounty amount for a resolved report (VDP Add-on only)

All write tools require the mcp_write scope when accessed via external MCP clients.

Example Prompts

Use these in the sidebar chat on any VDP page:

"Show me my triage queue — what's at risk of breaching SLA?"

"Check report rpt_abc123 for duplicates and suggest a severity."

"Draft a validation response for report rpt_abc123 explaining we've confirmed the SQL injection."

"What's our SLA compliance rate this month?"

"List all unassigned Critical reports."

"Triage report rpt_abc123 to Validated and assign it to Alice."

"Approve a $500 bounty for report rpt_abc123 — it's a High severity XSS."

"Show me the researcher profile for the person who submitted rpt_abc123."

"What does the bounty history look like for High severity findings?"

The assistant uses the read tools to gather context, then uses the write tools when you ask it to take action. You can chain commands naturally — “check for duplicates, suggest severity, and draft a response” runs three tools in sequence.

Connecting via MCP (External Clients)

For external AI assistants like Claude Desktop, Claude Code, or custom MCP agents, all 21 CSIRT tools are available through the MCP API. Write tools require the mcp_write scope.

See Connecting AI Assistants for setup instructions, authorization flow, and scope management.

Once connected, the external client has access to the same tool set as the built-in sidebar chat. Start with csirt_get_setup_guide to get an overview of your program before using other tools.

Quick Checklist

• Open a report and use the AI sidebar to try “Check for duplicates”
• Ask the assistant “What’s our SLA compliance this month?” from the VDP dashboard
• Try “Draft a dismissal response” on an out-of-scope report
• Review the AI screening badge on any flagged report to understand what triggered it
• Connect an external MCP client and call csirt_get_setup_guide to verify access
• Read Triaging Reports for the full triage workflow that these tools support