What this category of data looks like
Daily documents for vulnerability scanning services include scan plans, vulnerability lists, rectification work orders, and re-scan reports. Data sources are vulnerability scanners, asset lists, CVE databases, and patch announcements. Update frequency is weekly or monthly. Each data entry includes fields such as vulnerability CVE number, associated asset IP or domain name, vulnerability severity level, rectification status, and re-scan results. This is a combination of structured and semi-structured security operation data, used to support vulnerability discovery, rectification, and compliance auditing.
What constraints these characteristics impose on model integration and configuration
This category of data primarily uses structured security operation records with a fixed update frequency. Model integration does not require extremely high real-time throughput, but needs stable adaptation to long documents and structured field processing. Vulnerability data accuracy is directly linked to compliance audit results. This raises higher authentication and stability requirements for model calls. Time-consuming steps such as asset range confirmation and false positive elimination require the model to associate multiple document contents. The configured context window must cover associated data to avoid truncating key information. Data update cycles are fixed, so frequent adjustments to model adaptation logic are unnecessary. Stable parameter configurations can be adopted.
How to set configurations
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
AIPROXY_API_ENDPOINT | http://aiproxy:3000 (example root address, do not append the /v1 path) | Root address of the AI Proxy service for the App/Admin server required starting from FastGPT v4.17.0. Do not use single-model or downstream model provider API addresses such as VLLM/Ollama/Xinference. |
AIPROXY_API_TOKEN | Administrator token consistent with the AI Proxy server configuration, non-empty | Required environment variable for the official App/Admin server. Do not use application API keys or model provider secrets as a replacement. |
maxContext | 8000–12000 token | Adapts to context requirements for long documents such as re-scan reports and vulnerability lists, avoiding truncation of associated asset and rectification information. |
maxTokens | 2000–3000 token | Balances output length for vulnerability analysis and call costs, adapting to content output requirements for single-round vulnerability troubleshooting. |
temperature | 0.1–0.3 | Ensures stability of vulnerability classification and rectification suggestion output, avoiding misjudgments caused by excessive randomness. |
toolChoice | auto | Supports the model to independently choose whether to call tools to assist vulnerability verification or rectification suggestion generation, adapting to multi-step security review requirements. |
Three Common Mistakes
- Phenomenon: The App service returns a validation error for missing required environment variables during startup. Troubleshooting: Check if the App/Admin server has configured
AIPROXY_API_ENDPOINTand a non-emptyAIPROXY_API_TOKEN. This is a startup validation issue. - Phenomenon: Model calls return 404 path errors or connection failures. Troubleshooting: Check if
AIPROXY_API_ENDPOINTis the root address of the AI Proxy service, without appended/v1or downstream model API paths, and not a single-model address such as VLLM/Ollama/Xinference. - Phenomenon: External calls to the application API fail authentication. Troubleshooting: Check if
AIPROXY_API_TOKENwas mistakenly used as an application API key or model provider secret. The two types of authentication credentials have different use cases.
How to Confirm Successful Configuration
- Check the environment variable configuration on the App/Admin server. Confirm that
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare correctly set and non-empty. - Access the root address of the AI Proxy service. Verify that the service is running normally, with no connection timeouts or access denied errors.
- On the FastGPT model channel configuration page, test calling the configured upstream model. Confirm that model responses can be retrieved normally.
- Trigger the model-assisted review process for a vulnerability scan task. Check whether vulnerability classification results or rectification suggestions can be generated normally.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.