Data overview for this category
Data for this category primarily comes from source code repositories, dependency lists, static application security testing (SAST) tool outputs, and public vulnerability databases. Daily produced documents include code audit reports, vulnerability proof materials, repair suggestion documents, and retest records. Data updates are adjusted based on project version iterations or project progress, typically once per version or project. Single data entries include fields such as vulnerability ID, dangerous function location information, data flow trace paths, repaired code snippets, and retest results. There is no unified fixed unit, as values change based on specific audit content.
Constraints on knowledge base retrieval and recall
Scattered data sources and varied formats require the retrieval link to balance code semantic matching and text semantic understanding capabilities. Data formats include native code snippets, structured audit reports, and unstructured retest records. Data updates follow project version iterations, so recalled knowledge base content must be synchronized with the current audit project’s version to avoid using expired vulnerabilities or repair data. Single data entries contain precise location information and path details, so recalled results must cover core fields such as dangerous functions and data flow traces to support rapid positioning and review work for security research and development. The accuracy of audit data directly affects business risk, so the retrieval link must prioritize the recall of high-confidence results.
Configuration settings
These settings apply to FastGPT v4.17.0 and later versions:
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Matches semantic similarity for code security scenarios. Prevents retrieval of irrelevant vulnerabilities when set too low, and avoids missing valid audit records when set too high. |
limit | Top 10 entries | Covers the core reference data volume for a single audit task, balances retrieval efficiency and result completeness. |
searchMode | Hybrid retrieval | Balances keyword matching and semantic retrieval, adapts to mixed data formats of code snippets and audit reports. |
usingReRank | Enabled | Performs reordering on initial recall results, prioritizes returning highly relevant entries related to dangerous functions and vulnerability localization. |
datasetSearchUsingExtensionQuery | Enabled | Automatically expands retrieval keywords, supplements professional terms such as vulnerability IDs and dangerous function names, improves retrieval accuracy. |
collectionIds | Exclusive knowledge base ID for the corresponding audit project | Isolates audit data from different projects, avoids cross-project retrieval interference. |
Three common configuration errors
- Phenomenon: Retrieval results include expired vulnerability repair records or old version audit content. Cause: Knowledge base synchronization frequency is not updated according to project version requirements, and datasets not associated with the current audit project version are used.
- Phenomenon: Knowledge base images created via the localFile interface cannot be saved long-term, and become inaccessible after expiration. Cause: No permanent storage policy is configured for the knowledge base, and the default temporary expiration mechanism is used for uploaded files.
- Troubleshooting item: If an interface call returns an authentication failure (status code 401), check whether the AI Proxy administrator Token was mistakenly passed as the application API Key in external request headers, and the correct application authentication key was not used.
How to confirm configurations are properly set
- Check environment variables for the App/Admin server. Confirm that
AIPROXY_API_ENDPOINT(the root address of the AI Proxy service, for example http://aiproxy:3000, do not append /v1 or single model service addresses) and a non-emptyAIPROXY_API_TOKEN(AI Proxy administrator Token, consistent with the AI Proxy server configuration) are configured. Do not replace service deployment configurations by filling these values in workflow global variables, application API request headers, or the general model management page. - Send a test retrieval request. Verify that the number of returned results matches the
limitconfiguration value, and the similarity score falls within the set range ofsimilarity. - View knowledge base synchronization logs. Confirm that data updates have been completed according to the project version cycle, and no expired audit data remains.
- Check the model channel configuration page. Confirm that the upstream model’s channel address and supplier credentials are correctly configured. These settings are handled via model channel configuration, and must not be confused with AI Proxy service environment variables.
The provided values are common starting points and should be validated against local test datasets.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.