What This Category's Data Looks Like
Vulnerability scanning service data originates from vulnerability scanners, asset inventories, CVE databases, and patch announcements. Daily maintained documents include scan plans, vulnerability lists, remediation tickets, and rescan reports. Fields cover vulnerability IDs, CVSS scores, associated assets, remediation status, and more. Data updates occur weekly or monthly, with refreshes aligned with scan task execution, CVE database synchronization, and patch announcement updates.
What Constraints Do These Characteristics Impose on the "Tool Calling and Plugins" Link
Vulnerability scanning service data sources are scattered, and update rhythms are fixed. Tool calling must adapt to multi-source data synchronization logic. Tools must regularly pull CVE databases, scan results, and patch announcements to avoid using outdated vulnerability information. Daily document structures are fixed. Plugins must match the field formats of documents such as scan plans and vulnerability lists, and accurately extract core information including vulnerability IDs and associated assets. Update frequency is weekly or monthly. Tool trigger timing must align with scan task execution cycles to avoid excessive resource consumption from over-calling. Additionally, tools must support automatic pulling of asset inventories and filtering of false positive results, to adapt to the most time-consuming asset confirmation and false positive elimination processes.
How to Configure
These configuration instructions apply to FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
toolChoice | auto | Supports automatic recognition of vulnerability scenarios in code reviews, and adapts to different detection requirements |
functionCall | Allow arbitrary tool calls | Meets the need to freely use tools to handle problems, and adapts to cross-document vulnerability data integration |
| Tool call trigger timing | 10 minutes after scan plan execution completes | Aligns with the weekly/monthly update frequency of vulnerability scanning services, ensuring calls use the latest available data |
| Single call data volume | Top 20 vulnerability list entries | Avoids exceeding context limits in a single call, and adapts to batch processing scenarios for code reviews |
| Result filtering threshold | CVSS score ≥7.0 | Focuses on high-severity vulnerabilities, reducing interference from low-risk data during reviews |
| Call timeout setting | 300 seconds | Adapts to the time required for multi-source data pulling, and avoids task unresponsiveness |
Three Common Mistakes
- Phenomenon: Tool call returns non-target low-risk vulnerability data, and the output range cannot be restricted. Cause: No result filtering threshold is configured, and high-severity vulnerability fields are not prioritized, causing irrelevant data to be included in the context.
- Phenomenon: Vulnerability data obtained via tool calls is not correctly passed to downstream AI models, and downstream models cannot absorb relevant knowledge. Cause: No result output format for tool calls is configured, and no logic is specified to pass data to the specified model, causing data flow to interrupt.
- Phenomenon: Scheduled tool calls frequently time out, or trigger timing does not match scan plans. Cause: No reasonable call timeout duration is set, and the weekly/monthly execution cycle of scan plans is not aligned, causing incorrect call timing or task failure.
How to Verify Proper Configuration
- Perform a manually triggered tool call, check if the returned vulnerability data includes entries within the configured filtering threshold, and confirm that field extraction is correct.
- View tool call logs to confirm that trigger timing aligns with scan plan execution cycles, with no abnormal timeout records.
- Configure the logic for downstream models to receive tool call results, test whether data can normally flow to the target model, with no missing fields or format errors.
- Adjust the
toolChoiceparameter toauto, verify that it can automatically recognize vulnerability scenarios in code reviews and call corresponding tools.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.