README.md

metadata

title: AI Services
emoji: 🛡️
colorFrom: gray
colorTo: blue
sdk: docker
app_port: 7860
pinned: true

Swagger UI:https://dn-scribe-ai.hf.space/docs

CVE Analysis Service for streaming markdown reports and JSON-based analysis using OpenAI.

Try it out here

• /viewer?cve_id<CVE-ID>&refresh=<true|false> → live stream report
• /cached → raw markdown report
• /json?cve_id=<CVE-ID>&refresh=<true|false> → JSON response
• /healthz → health check
• /raw?cve_id=<CVE-ID>&refresh=<true|false> → Returns raw markdown report content. If the report does not exist, it generates it using OpenAI.
• /cve_info?cve_id=<CVE-ID> → Fetches CVE information as JSON with error handling.
• /ghsa_to_cve?ghsa_id=<GHSA-ID> → Converts GHSA ID to CVE ID using OpenAI.
• /report?prompt_name=<FILE NAME>&prompt_prompt=<PROMPT>&prompt_params=<{"var1": ..."}> → Returns raw markdown report content. If the prompt file does not exist, uses prompt_prompt instead.
• /report_json?prompt_name=<FILE NAME>&prompt_prompt=<PROMPT>&prompt_params=<{"var1": ..."}> → Returns JSON response. If the prompt file does not exist, uses prompt_prompt instead.

Swagger available (on hugging face) here

Detailed Documentation: /report and /report_json Endpoints

Overview

The /report and /report_json endpoints provide dynamic report generation using custom prompts and parameters. They support both GET (query parameters) and POST (JSON body) methods. These endpoints are designed for advanced use cases where you want to generate either Markdown or JSON reports using a specific prompt template and input parameters.

---

Prerequisites

• Prompt Files:
  • For /report, a Markdown prompt file named <prompt_name>.md must exist in app/prompts/.
  • For /report_json, a JSON prompt file named <prompt_name>_json.md must exist in app/prompts/.
• If the specified prompt file does not exist, you must provide the prompt content directly via the prompt_prompt parameter.

---

Input Parameters

Both endpoints accept the following parameters (either as query parameters for GET or as a JSON body for POST):

• prompt_name (string, optional):
  The base name of the prompt file (without extension).
  • For /report, looks for app/prompts/<prompt_name>.md
  • For /report_json, looks for app/prompts/<prompt_name>_json.md
• prompt_prompt (string, optional):
  The prompt content to use if the prompt file is not found.
• prompt_params (object, optional):
  A dictionary of variables to substitute into the prompt template.

Example JSON body:

{
  "prompt_name": "finding",
  "prompt_prompt": null,
  "prompt_params": {
    "cve_id": "CVE-2024-9900",
    "description": "Buffer overflow in XYZ"
  }
}

---

/report Endpoint

• GET /report?prompt_name=<NAME>&prompt_prompt=<PROMPT>&prompt_params=<JSON>
• POST /report (with JSON body as above)

Returns:
A Markdown report as plain text.

Example GET:

curl -G "http://localhost:8000/report" \
  --data-urlencode "prompt_name=finding" \
  --data-urlencode "prompt_params={\"cve_id\":\"CVE-2024-9900\"}"

Example POST:

curl -X POST "http://localhost:8000/report" \
  -H "Content-Type: application/json" \
  -d '{"prompt":{"name":"finding","params":{"cve_id":"CVE-2024-9900"}}'

---

/report_json Endpoint

• GET /report_json?prompt_name=<NAME>&prompt_prompt=<PROMPT>&prompt_params=<JSON>
• POST /report_json (with JSON body as above)

Returns:
A JSON object with the generated report.

Example GET:

curl -G "http://localhost:8000/report_json" \
  --data-urlencode "prompt_name=finding" \
  --data-urlencode "prompt_params={\"cve_id\":\"CVE-2024-9900\"}"

Example POST:

curl -X POST "http://localhost:8000/report_json" \
  -H "Content-Type: application/json" \
  -d '{"prompt":{"name":"finding","params":{"cve_id":"CVE-2024-9900"}}'

---

Output

• /report: Returns a Markdown string.
• /report_json: Returns a JSON object, typically with a body field containing the report.

Example /report_json response:

{
  "body": {
    "cve_id": "CVE-2024-9900",
    "summary": "Buffer overflow in XYZ...",
    "severity": "High"
  }
}

---

Error Handling

• If the required prompt file is missing and no prompt_prompt is provided, the endpoint returns a 400 error.
• If the generated output is not valid (e.g., invalid JSON for /report_json), a 500 error is returned with details.

---

Summary Table

Endpoint	Method	Input Location	Output Type	Prerequisite File(s)
/report	GET	Query params	Markdown	app/prompts/<prompt_name>.md
/report	POST	JSON body	Markdown	app/prompts/<prompt_name>.md
/report_json	GET	Query params	JSON	app/prompts/<prompt_name>_json.md
/report_json	POST	JSON body	JSON	app/prompts/<prompt_name>_json.md

Example of converting GHSA to CVE:

curl -X GET "http://127.0.0.1:8000/ghsa_to_cve?ghsa_id=GHSA-832w-fhmw-w4f4" -H "accept: application/json"

{"ghsa_id":"GHSA-832w-fhmw-w4f4","cve_id":"CVE-2024-55890"}

MCP Config for VSCode: Create a file named mcp.json in the .vscode folder of your project and add the following content:

{
    "servers": {
        // "cve_analysis__debug": {
        //     "type": "sse",
        //     "url": "http://localhost:8000/mcp"
        // },
        "cve_analysis_hf": {
            "type": "sse",
            "url": "https://dn-scribe-ai.hf.space/mcp"
        }
    }
}

Function to convert from GHSA to CVE-ID:

A function based on OpenAI gpt-4o-mini-search-preview with costs as follows:

• 25$ per 1k API calls
• 0.15$ per 1M input tokens
• 0.60$ per 1M output tokens

Since the whole transaction is about 40 tokens, the real cost is the per-api-call cost.