What this category of data looks like
This category of data comes from private vulnerability reports, code repositories, CVE numbering bodies, and official release channels. Core documents include security advisories, vulnerability reports, fix patches, and CVE application materials. Each document has fixed fields including CVE ID, disclosure time, impact scope, patch links, etc. The update rhythm is based on individual vulnerability events, with no fixed cycle. The data is linked to the full lifecycle process of the project’s own vulnerabilities. All information from vulnerability reporting to public disclosure must be included in the summary.
What constraints these characteristics impose on the context and token workflow
This category of data is updated per individual vulnerability event. The number of documents and field complexity associated with a single event are relatively high. The total content carried by the context must be strictly limited to avoid token overflow. Since the data includes two types of content: private vulnerability reports and publicly released information, the context must distinguish permission scopes, and only authorized content should be included in the invocation context. At the same time, the timeliness requirement for vulnerability disclosure is high. Context recall must accurately match the associated documents of the current event, avoid introducing irrelevant historical data that occupies tokens, and prevent disclosure process delays or information leaks caused by redundant context.
How to configure settings
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
maxContext | 12000–15000 token | Adapts to the total length of documents such as security advisories and patch reports associated with a single vulnerability event, avoiding token overflow |
quoteMaxToken | 2000–3000 token | Matches the typical length of a single vulnerability report or patch note, ensuring a single quoted piece of content is complete without occupying excessive context space |
| Context recall limit | Top 8 entries | Covers the core associated documents of the current vulnerability event, avoiding the introduction of irrelevant historical data |
| Permission filtering toggle | Enabled | Filters undisclosed private vulnerability reports, only including authorized content in the context |
| Event context binding | Bind current vulnerability ID | Ensures recalled documents are only associated with the currently processed vulnerability event, avoiding cross-event interference |
Three common misconfigurations
- Results returned when calling the workflow API do not include context information for the current vulnerability event. The cause is failing to bind the context identifier of the corresponding vulnerability event in the API request, or the context configuration within the workflow not being linked to the exclusive document source for this event.
- Token consumption far exceeds daily usage. The cause is failing to set a reasonable value for
maxContext, resulting in excessive irrelevant historical vulnerability documents being loaded on each invocation, occupying excess token quota. - After deploying the BGE reranking model, the number of associated documents recalled by the context does not meet expectations. The cause is failing to configure the correct associated parameters in the environment field of docker-compose.yml, causing the model to fail to correctly match the contextual association between vulnerability reports and patches.
How to confirm the configuration is correct
- Initiate a test invocation using FastGPT v4.17.0, and check whether the returned results include core information such as security advisories and patch links associated with the current vulnerability event.
- View the API call logs to confirm that the actual values of
maxContextandquoteMaxTokenmeet the configuration requirements, with no excess token consumption. - Verify the permission filtering function by attempting to call an interface related to an undisclosed private vulnerability report, confirming that unauthorized private content is not included in the returned results.
- Check the running logs of the BGE reranking model to confirm that the number of associated documents recalled by the context meets the preset recall limit.
The values provided here are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.