What data for this category includes
The data for this category primarily originates from target system logs, public vulnerability databases, automated scanner outputs, and red team manual verification records. Daily deliverable documents include test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Data updates follow individual test project cycles, or are synchronized during major version iterations of target systems. Data fields cover test scope, vulnerability identifiers, exploitation paths, risk ratings, rectification requirements, and similar items. There are no unified fixed units, and fields adjust based on the document structure of individual projects.
Constraints imposed on context and token handling
Data for this category is multi-source and isolated per project. Context must be strictly bound to exclusive data such as authorization letters and reports for a single test project, to prevent cross-project context contamination. Data includes both structured scan results and unstructured manual verification records. Mixed formats increase token processing complexity, and single-context token consumption varies widely. Use maxContext to set an overall upper limit for context tokens, and quoteMaxToken to limit the token length of a single quoted entry. Data updates align with project progress. The effective range of the context must match the project cycle, to avoid referencing expired scan or verification data. Key information related to authorization compliance and risk ratings must retain sufficient token length to be fully preserved, preventing key fields from being truncated.
How to set configurations
| Configuration Item | Recommended Range | Rationale |
|---|---|---|
maxContext | 8000–12000 token | Penetration test documents include multiple reports and verification records, requiring sufficient context to associate test scope and vulnerability details |
quoteMaxToken | 2000–3000 token | The token length of a single quoted vulnerability report or scan result must be controlled to avoid overloading single requests |
| Single recall count | Top 3–5 entries | Penetration test data is aggregated by project. Too many recalls increase token consumption, while too few may miss critical vulnerability paths |
| Context reordering | Enabled | Prioritize recalling high-risk vulnerability data related to the current test task to improve context accuracy |
| Query optimization | Enabled | Requirement descriptions for penetration test tasks often include technical details; optimization enables more precise recall of relevant documents |
| Context binding cycle | Calibrated to project cycle | Must align with the lifecycle of a single test project to avoid accidental inclusion of cross-project data in the context |
Three common configuration mistakes
- Phenomenon: Token consumption returned by a single request exceeds the configured
maxContextlimit, or an "context too long" error is displayed. Cause: Context is not isolated per test project, and authorization letter or report data from multiple projects is included in the context, leading to excessive token accumulation. - Phenomenon: MCP tool calls cannot retrieve global variable tokens in the workflow. Cause: Global variable tokens are not configured as context parameters, and project-specific context variables are not bound in the tool call node.
- Phenomenon: Knowledge base recalled documents include expired scan results, or fail to prioritize high-risk vulnerability reproduction records. Cause: No binding rule between context and project cycle is set, allowing expired data to be included in the context.
How to verify correct configuration
- View context logs in FastGPT v4.17.0, confirm that the context token value for each request falls within the configured
maxContextrange. - Initiate a test task, check the parameter configuration of the MCP tool call node, confirm that global variable tokens from the workflow are passed in.
- Switch between different test projects, verify that documents recalled by the knowledge base only belong to the current project, with no cross-project data included.
- Adjust the single recall count, initiate a test request, confirm that the number of recalled documents matches the configured value, and that highly relevant vulnerability data is displayed first.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.