What data for this category looks like
Code security auditing data comes from source code repositories, dependency lists, static application security testing (SAST) tools, and public vulnerability databases. Data updates in sync with project versions or code changes. A single audit covers standardized code audit reports, vulnerability proof materials, remediation recommendation documents, and retest records. Data fields include vulnerability level identifiers, dangerous function location results, file paths, attack path analysis, repaired code snippets, and more. There are no unified fixed units. Values vary based on the code volume and complexity of the audit target.
Constraints on tool calling and plugins
Code security auditing data draws from multiple source types. Tool calling must connect to source code, dependency libraries, SAST tools, and vulnerability databases simultaneously. It requires configuration of collaborative calling logic across multiple tools. Data updates frequently with project versions or code changes. Tool calling trigger timing must sync with code changes to ensure the latest audit data is used. Audit documents include multiple standardized fields. Tool calling must support extracting target content based on field rules to match the standard format of audit reports. Dangerous function location and data flow tracking processes long code text. Tool calling must adapt to large text transmission and processing durations to avoid timeout interruptions.
How to set configurations
In FastGPT v4.17.0, tool calling mode and output format can be configured using the toolChoice and functionCall parameters. Below are specific configuration recommendations:
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
toolChoice | Specify the code security auditing tool collection | Adapt to tool calling needs for different audit scenarios, cover source code, dependency, and vulnerability database data sources |
| Tool calling timeout duration | 300-600 seconds | Adapt to audit processing durations for long code text, avoid timeout interruptions caused by large data volumes |
functionCall | Enable structured output mode | Standardize extraction of audit report fields such as vulnerability level and file path, ensure output format meets audit document requirements |
| MCP tool retry count | 2 times | Address scenarios including network fluctuations or temporary tool unavailability, improve call success rate |
| Local tool container upload limit | 1000 MB | Adapt to conventional sizes of code audit files, cover code volume requirements for most projects |
| Field extraction matching rules | Match by vulnerability level, file path, and remediation recommendation fields | Match the standard document structure of code audit reports, ensure accuracy of extracted content |
Three common mistakes
- Symptom: Audit data fields returned after calling an HTTP interface are empty. Cause: No extraction rules configured for corresponding fields, no matching standard field structure of code audit reports.
- Symptom: MCP tool call fails, returns 500 status code. Cause: No dependency environment adaptation configured for the tool, no synchronized vulnerability database index files required for code auditing.
- Symptom: Locally deployed MinerU tool fails to process code files, returns upload size limit exceeded prompt. Cause: Default 2MB upload limit not modified when starting the container, no adaptation to actual size of code audit files.
How to confirm configurations are correctly set
- Initiate a simulated code change review, check FastGPT v4.17.0 tool calling logs, confirm specified audit tools are correctly triggered.
- Review tool return results, confirm whether standard audit fields such as vulnerability level and file path are extracted, match preset extraction rules.
- Test API calls, confirm call timeout duration falls within the configured 300-600 second range, no abnormal timeout interruptions occur.
- Check startup parameters of the local MinerU tool container, confirm upload file limit has been adjusted to the target value, no default 2MB limit prompt appears.
The values provided are common starting points, and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.