Data Profile for This Category
The core data for penetration testing services originates from target systems, public vulnerability databases, automated scanner results, and manual attack verification records. Daily deliverables include test authorization letters, penetration test reports, vulnerability reproduction records, and remediation recommendations. Fields covered include vulnerability CVE IDs, reproduction steps, risk ratings, authorization scopes, and more. Data updates follow cycles tied to individual projects or major system version changes. Data formats vary widely across sources: scan results are structured tables, while manual records are mostly unstructured text.
Constraints Imposed on Tool Calling and Plugins
Due to diverse data sources and significant format differences, the tool calling link requires unified input and output format adaptation to prevent parsing errors across different data sources. Since data update cycles vary per project, plugins must support on-demand retrieval of the latest vulnerability databases and scan results to maintain analysis timeliness. As test authorization-related documents are included, authorization identifiers must be included during tool calling to avoid legal authorization disputes. Because the majority of time is spent on vulnerability verification and rating, tool calling timeout settings must align with the typical duration of manual verification to prevent task interruptions.
How to Set Configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
toolChoice | auto | Adapts to the need for automatic scheduling of multiple tools in penetration testing scenarios, no need to manually specify a single tool |
functionCall | enabled | Supports structured output of vulnerability reproduction steps and risk ratings, avoiding unformatted text interfering with report generation |
| Tool call timeout duration | 300–600 seconds | Matches the processing duration of manual verification and long-text scan results, preventing task interruptions mid-process |
| Plugin update frequency | Every 7 days | Matches the regular update rhythm of public vulnerability databases, ensuring tool calls use the latest vulnerability data |
| Maximum number of results returned per tool call | Top 20 entries | Adapts to the typical number of entries in penetration test reports, avoiding result overload |
| Maximum context length | 8000–12000 token | Adapts to the long-text processing needs of vulnerability reproduction records, fully retaining key verification information |
Three Common Misconfigurations
- Symptom: Tool call results include unprocessed "reference marker: [1]" text. Troubleshooting: Check if the
functionCallparameter is set toenabled, and confirm that structured output rules are activated. - Symptom: Plugin call returns a 401 Unauthorized status code. Troubleshooting steps:
- Verify that the FastGPT server has configured
AIPROXY_API_ENDPOINT(the root address of the AI Proxy service, for example http://aiproxy:3000; do not append paths such as /v1) and a non-emptyAIPROXY_API_TOKEN(AI Proxy administrator token, must match the AI Proxy server configuration). - Confirm that other credentials such as application API keys or model vendor keys are not used as
AIPROXY_API_TOKEN. - Confirm that this variable is not configured in workflow global variables, application API request headers, or the general model management page.
- Verify that the FastGPT server has configured
- Symptom: Workflow tool call returns a parameter missing error. Troubleshooting: Check if required fields such as test authorization letter number and target system identifier are passed as required for the scenario.
How to Verify Correct Configuration
- Review the FastGPT server's environment variable configuration, confirm that
AIPROXY_API_ENDPOINT(root address of the AI Proxy service, for example http://aiproxy:3000; do not append paths such as /v1) and a non-emptyAIPROXY_API_TOKEN(AI Proxy administrator token, must match the AI Proxy server configuration) are set with no missing items. - Trigger a tool call, and confirm that returned results are in structured format with no unprocessed reference markers.
- Verify that the plugin can regularly pull the latest vulnerability database data with no update delays or error messages.
- Simulate a tool call request without an authorization identifier, and confirm that the system intercepts the request and returns a permission error.
The values provided are common starting points and should be evaluated against deployment-specific samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.