sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 62 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

docs: document Nuclei/ZAP as decided deterministic detectors under the agentic DAST (not yet implemented)
CI / Check (push) Skipped
CI / Check (pull_request) Failing after 2m55s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details

Browse Source 
Spec v0.2.1 decision (2026-08-31): keep the agentic DAST/pentest layer, integrate
Nuclei then ZAP baseline underneath as deterministic detectors feeding the
control-map LUT; offline vuln DB (Trivy/Grype) on the on-prem runner trigger.
Clearly marked as planned so the docs stay truthful until the code lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
This commit is contained in:
Sharang Parnerkar
2026-08-31 15:12:41 +02:00
co-authored by Claude Fable 5
parent b7b9c812ab
commit 61c6eab54e
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/tools.md
+11
View File
@@ -96,3 +96,14 @@ When you mark findings as false positives or provide developer feedback, this in
::: tip
The AI triage is a starting point, not a final verdict. Always review the rationale and code evidence before acting on a finding. See [Understanding Findings](/guide/findings#human-in-the-loop) for more on the human-in-the-loop workflow.
:::
## Planned integrations (decided 2026-08-31, not yet in the code)
The product spec keeps an **OSS-only** tooling policy and a control-mapping rule of *tools detect, the LLM judges*. Two deterministic detectors are therefore being added **underneath** the agentic DAST/pentest layer — the agents stay on top for context-seeded exploitation, chaining and explanation:
| Tool | Role | Status |
|------|------|--------|
| [Nuclei](https://github.com/projectdiscovery/nuclei) | Template-driven checks (CVE probes, default credentials, exposed panels, misconfigurations) including ICS/OT templates for WebVisu / OpenPLC / HMI endpoints. Runs as a DAST phase and as a Werkbank job with vendored templates so it works on-prem. | Planned — tracked as an issue |
| [OWASP ZAP](https://www.zaproxy.org/) | Baseline (passive) and, behind the destructive-tests flag, active scan for reproducible spider + rule coverage; results seed the pentest agent. | Planned — follows Nuclei |
Both feed the same `control-map` lookup table as Semgrep, so their findings receive compliance `control_refs` through the grounded judge. An **offline vulnerability database** (Trivy preferred, Grype as alternative) is planned for the on-prem Werkbank runner, which cannot reach the OSV.dev / NVD APIs. Until these land, DAST findings come exclusively from the in-house agents described above.