What this category of data looks like
This category of data primarily originates from source code repositories, dependency lists, static application security testing (SAST) tools, and public vulnerability databases. Updates align with project version iterations or individual audit task progress. Daily produced documents include code audit reports, vulnerability proof materials, repair recommendation documents, and retest records. Fields cover vulnerability severity, associated code lines, attack paths, repair solutions, and more. There are no unified fixed units; values adjust based on the code scale and risk level of the audit project.
What constraints these characteristics impose on the "tool calling and plugins" workflow
The requirement to pull data from multiple sources means plugins must support integration with various tools and repositories. The on-demand triggering feature requires calling logic to adapt to the iteration rhythms of different projects. Structured document fields require plugins to accurately extract and associate corresponding data. The manual review link requires plugins to support workflows that combine AI analysis and human review.
How to configure the setup
This document applies to FastGPT v4.17.0 tool calling and plugin configurations. The specific configuration items are as follows:
| Config Item | Suggested Value | Rationale |
|---|---|---|
functionCall | Enabled and specified as a code security audit-specific function | Adapts to the structured output requirements of code security auditing, enabling accurate extraction of core fields such as vulnerability severity and associated code |
toolChoice | Set to auto | Allows the AI to independently select corresponding plugins such as code repositories and SAST tools, meeting the flexible needs of multi-source data pulling |
| Single call timeout threshold | 600 seconds | Covers time-consuming operations including code repository pulling and SAST result parsing, preventing task interruptions mid-process |
| Plugin data source whitelist | Only add source code repositories and SAST tool addresses associated with the project | Prevents calls to unauthorized data sources and reduces supply chain risks |
| Maximum recalled related documents | Top 20 entries | Limits the number of documents returned per call, avoiding context overload that impacts analysis efficiency |
| Maximum document characters returned per call | 8000 characters | Adapts to the typical text length of code audit reports, ensuring analysis content is complete and does not exceed context limits |
Three common configuration mistakes
- Symptom: Empty results are returned when calling
functionCall, or the error "function calling is not supported" is thrown. Cause: The AI model's function calling permission is not configured correctly, or the locally deployed model does not have function calling support enabled. - Symptom: Plugin calls time out and return a 504 status code. Cause: The timeout threshold is set too low, failing to cover the actual time required for code repository pulling or SAST result parsing.
- Symptom: Vulnerability data returned by the plugin does not match the actual code. Cause: The project-specific data source whitelist is not configured, and non-associated vulnerability databases or code repositories are called.
How to verify a correct configuration
- Manually trigger a tool call, and check whether code fragments from the specified source code repository or scan results from the SAST tool are retrieved.
- Review the structured data output by the AI, confirm that preset fields such as vulnerability severity and associated code lines are included, and verify that the
functionCallconfiguration is active. - Adjust the timeout threshold to 120 seconds, simulate a call operation with low time consumption, and confirm that the call is not interrupted due to timeout.
- Check the plugin data source configuration, confirm that only addresses associated with the project are included, with no additional unauthorized sources.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.