What Data for This Category Looks Like
Data for this category comes from private vulnerability reports, code repositories, CVE numbering bodies, and official release channels. Daily produced documents include security advisories, vulnerability reports, fix patches, and CVE application materials. Data updates follow a single vulnerability event cycle, with each event corresponding to a complete vulnerability disclosure and remediation workflow. Data fields include vulnerability ID, impact scope, remediation progress, disclosure time, patch links, and more. There is no unified fixed batch unit; each single vulnerability event is managed independently.
Constraints Imposed on Tool Calling and Plugins by These Characteristics
Since the data includes private vulnerability reports, tool calling requires permission isolation rules to prevent sensitive information leaks via external calls. Data updates follow single event cycles, so tool calling must support on-demand triggering to adapt to temporary vulnerability response workflows, and fixed scheduled scheduling must not be used. There are diverse document types in this category, including code patches, structured reports, and unstructured advisories, so tool calling must support multi-format input and parsing of different types of vulnerability-related files. Fields are managed per single vulnerability event, so tool calling must support precise matching and calling of individual data entries to avoid information confusion from batch processing.
Configuration Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
toolChoice | auto | Automatically select tools for different vulnerability scenarios, no need to manually specify specific tools |
functionCall | enabled | Support calling external security tools to parse patches and CVE application materials |
| Tool call timeout | 600 seconds | Adapt to the long execution time requirements of tools during vulnerability response workflows |
| Tool call permission scope | Only private vulnerability report libraries and code repositories | Prevent sensitive vulnerability information from being leaked via tool calls |
| Maximum data per single call | 1 entry | Process each single vulnerability event independently, avoid batch data interfering with review workflows |
Three Common Configuration Mistakes
- The symptom is that the knowledge base selection option does not appear in the tool calling panel. The cause is that the tool calling permission for associated knowledge bases was not enabled in the configuration, and only general tool calling permissions were opened.
- The symptom is that after uploading an XLSX-format vulnerability report, the AI cannot parse the content. The cause is that the document parsing plugin for the corresponding format was not configured, and only text and code format parsing is supported by default.
- The symptom is continuous timeouts when the workflow repeatedly calls HTTP interfaces. The cause is that no reasonable retry mechanism was set, and the timeout threshold was set too short, failing to adapt to temporary delays in vulnerability data retrieval.
How to Verify a Successful Configuration
- Enter the tool calling configuration page of FastGPT v4.17.0, confirm that the
toolChoiceparameter is set toautoor the specified security tool type. - Upload a test XLSX-format vulnerability report, verify that the parsing result includes core fields such as vulnerability ID and impact scope.
- Trigger a tool call for a test vulnerability, check whether the workflow can normally repeatedly call HTTP interfaces to obtain CVE-related data.
- View the tool calling logs, confirm that there are no permission error, timeout prompt, or format parsing failure records.
The values provided here are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.