What data for this category looks like
All data for this category centers on individual vulnerability events. Sources include private vulnerability reports, project code repositories, publicly available information from CVE-numbering bodies, and official release channels. Data is updated once per event. Single-event data includes fields such as vulnerability ID, impact scope, disclosure time, repair patch links, and reporter information. Daily documents include security advisories, vulnerability reports, repair patch packages, and CVE application materials, most often in structured text or Markdown formats.
What constraints these characteristics impose on model integration and configuration
This category’s data contains sensitive vulnerability details and cross-team coordination records. Model integration must prioritize data transmission security, and public third-party proxy interfaces must not be used. Single-event data lengths vary widely, from hundreds to thousands of characters. The model’s context and output length must be limited to avoid exceeding interface quotas. Data fields are relatively fixed but require precise extraction. Configure the model’s output format constraints to ensure analysis results meet vulnerability processing workflow requirements. Vulnerability handling has strict timeliness requirements, so configure reasonable timeout and retry mechanisms to avoid delaying disclosure coordination progress.
How to configure settings
The following configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
maxContext | 8000–12000 token | Adapts to the full context length of a single vulnerability event, including vulnerability reports, patch information, and historical coordination records |
maxTokens | 2000–3000 token | Limits the length of vulnerability analysis results output by the model, avoids exceeding interface quotas, and simplifies subsequent manual review |
AIPROXY_API_ENDPOINT | Root address of the AI Proxy service, for example http://aiproxy:3000 | Access address of the AI Proxy service configured for the FastGPT server, do not append paths such as /v1 or /chat/completions |
AIPROXY_API_TOKEN | Non-empty administrator token matching the AI Proxy server configuration | Authentication credential for the FastGPT server to access the AI Proxy service |
temperature | 0.3–0.5 | Balances accuracy and flexibility of vulnerability analysis, avoids generating irrelevant or inaccurate assessment content |
toolChoice | auto | Allows the model to automatically decide whether to call tools to assist in vulnerability impact scope assessment |
Three common configuration errors
- A 401 unauthorized error is returned when calling the model. Troubleshooting steps:
AIPROXY_API_TOKENis not configured correctly, or the token does not match the administrator token configured on the AI Proxy server. - The AI model dropdown list in the workflow is empty. Troubleshooting steps: Required environment variables
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare not configured correctly, FastGPT server startup verification failed, or the AI Proxy service is not running properly. - Vulnerability impact assessment results exceed expected length. The cause is that the
maxTokensparameter is not restricted, causing the model to output redundant content and increasing manual review burden.
How to confirm configuration is complete
- Verify that the
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENenvironment variables set during FastGPT deployment match the corresponding configurations on the AI Proxy server. - Enter the FastGPT workflow editor, open the model selection dropdown list for the AI node, and confirm that the target model is displayed in the list.
- Submit simulated vulnerability report data to trigger a model call, and confirm that no permission errors or timeout prompts are returned in the results.
- Adjust the
maxTokensparameter to 1000 token, submit a test input, and confirm that the model output length conforms to the set limit.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.