This page is based on configuration instructions for FastGPT v4.17.0.
What the data for this category looks like
The core data for this category comes from package managers, code repositories, vulnerability databases, and license databases. Four document types are regularly generated: SBOM lists, dependency risk reports, license lists, and repair work orders. Data updates occur daily or alongside software version releases. Most documents use structured fields, including component name, version number, vulnerability severity, license type, repair status, and additional relevant fields. No unified fixed units apply, and fields vary slightly based on data source type. This data supports daily governance work for security teams, development efficiency teams, and open source governance offices.
Constraints on Knowledge Base Retrieval and Recall
Data for this category originates from multiple technical data sources. High-frequency updates require the retrieval pipeline to support near-real-time synchronization. Structured document fields require retrieval to accurately match attributes such as component name and vulnerability severity, to avoid generalized recall. Document volume grows with the scale of dependency components, so single-batch retrieval data range must be limited to prevent context overload. Repair work orders are strongly linked to dependency risks, so recall results must associate the full context of corresponding components to provide accurate support for pre-sales Q&A and technical support.
How to Set Configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Matches structured fields of supply chain security documents, avoids redundant recall of unrelated dependency components, and adapts to the precise needs of pre-sales Q&A |
limit | Top 8–12 entries | Controls the number of results returned per retrieval round, adapts to the context length of multi-field documents such as SBOM lists and vulnerability reports within 1000 characters |
searchMode | vector | For structured dependency data, vector retrieval can accurately match component names and vulnerability information, which performs better than keyword matching logic |
usingReRank | Enabled | Reranks initial recall results, prioritizes returning high-priority content such as high-severity vulnerabilities and license violations, and adapts to emergency technical support scenarios |
datasetSearchUsingExtensionQuery | Enabled | Expands query terms related to dependent components and vulnerability types based on user questions, improving recall rate across data sources |
collectionIds | Bind exclusive knowledge base collections | Isolates supply chain security data from documents of other categories, prevents unrelated content from being included in retrieval results |
Three Common Misconfigurations
- Symptom: Original documents uploaded to the knowledge base cannot be queried. Cause: The storage path or permission of the document is not configured correctly, so the original document cannot be associated during retrieval.
- Symptom: The API returns a reading link for knowledge base documents, and clicking the link prompts that only .txt and .m format files are supported. Cause: Uploaded documents such as dependency risk reports and SBOM lists have not been converted to parseable formats supported by the platform, so the link cannot be accessed normally.
- Symptom: Response accuracy is insufficient after chunking documents imported into the knowledge base. Cause: Chunking rules do not match the structured fields of category documents, or the document template for the corresponding category is not used, so core information cannot be accurately associated during retrieval.
How to Verify Configuration Completion
- Confirm that knowledge base collections are only bound to supply chain security related documents such as SBOMs and vulnerability reports, with no data from other categories included.
- Retrieve for questions about high-severity dependent components, verify that
similarityscores of returned results fall within the preset range. - After triggering retrieval, check the number of returned results to confirm it matches the set
limitparameter. - After enabling
usingReRank, verify that the priority of returned results follows the business logic of prioritizing high-severity vulnerabilities.
The values provided are common starting points, and should be evaluated against local samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.