What Data for This Category Looks Like
The data for this category primarily comes from source code repositories, dependency lists, static application security testing (SAST) tools, and public vulnerability databases. Daily produced documents include code audit reports, vulnerability proofs, repair suggestions, and retest records. Data is updated per project version or single audit task. A single data entry usually contains code snippets, vulnerability location information, risk level tags, and corresponding repair guidelines, and must be associated with the code version and dependency component information of the corresponding project. This documentation is based on the functional logic of FastGPT v4.17.0.
Constraints Imposed on Model Access and Configuration
Decentralized data sources linked to code versions and dependency components require model access to support context association for multi-source data, and avoid splitting output results from different tools. Data volume updated by version or task fluctuates greatly, so reasonable context length limits must be configured to prevent exceeding the model's processing upper limit. Daily documents include code snippets and repair guidelines, requiring the model to support long-text input and structured content parsing, while adapting to audit report fields in different formats. In addition, data must be associated with project metadata, so the configuration link must support binding corresponding project identifiers to ensure that audit results output by the model can be traced.
How to Configure Settings
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
AIPROXY_API_ENDPOINT | Root address of the AI Proxy service, for example http://aiproxy:3000 | Root access address of the AI Proxy service configured for the FastGPT App/Admin server, to ensure normal connectivity to the AI Proxy service |
AIPROXY_API_TOKEN | AI Proxy administrator token, consistent with the AI Proxy server configuration and non-empty | Used to verify the call permission between FastGPT and the AI Proxy service, preventing unauthorized access to the AI Proxy service |
maxContext | 8000–12000 token | Adapt to the long-text input requirements of code audit reports, avoiding model truncation caused by overly long context |
maxTokens | 2000–3000 token | Match the output length requirements of code audit results, ensuring that repair suggestions and vulnerability analysis can be returned completely |
temperature | 0.2–0.4 | Reduce output randomness, ensuring the accuracy and consistency of vulnerability location and repair suggestions |
toolChoice | auto | Allow the model to independently choose whether to call tools to handle logic analysis tasks related to code security |
Three Common Misconfigurations
- Symptom: Model service calls return a 500 error or no valid results. Troubleshooting steps: Check if
AIPROXY_API_ENDPOINTis the root address of the AI Proxy service, without additional paths such as/v1, and confirm normal connectivity to the AI Proxy service. - Symptom: After each MCP tool call, the context of subsequent conversations is cleared or part of the audit data is lost. Cause:
maxContextis not configured to adapt to context retention for multi-round audit tasks, or project metadata is not correctly bound after tool calls, leading to context reset. - Symptom: The time taken for the model to generate vulnerability analysis or repair suggestions is too long. Cause:
maxTokensis set too high, exceeding the model's concurrent processing limit, or the trigger range oftoolChoiceis not reasonably restricted, causing the model to repeatedly call unnecessary tools.
How to Verify Successful Configuration
- Import a small code snippet or a short audit report snippet, initiate a model call, and check whether vulnerability location results can be returned normally, to verify the configuration validity and connectivity of
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKEN. - Import a complete code audit report, check that the model output content is not truncated, to verify the rationality of
maxContextandmaxTokensconfigurations. - Trigger an MCP tool call, then initiate multiple rounds of audit-related conversations, check whether the context is normally retained, to verify the validity of
toolChoiceand context binding configurations. - Adjust the
temperatureparameter, then run two identical audit tests, compare the differences in output results, and confirm that the output randomness meets expectations.
The values provided are common starting points and should be measured against samples from the target deployment.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.