--- title: AI Services emoji: 🛡️ colorFrom: gray colorTo: blue sdk: docker app_port: 7860 pinned: true --- [Swagger UI:https://dn-scribe-ai.hf.space/docs ](https://dn-scribe-ai.hf.space/docs) CVE Analysis Service for streaming markdown reports and JSON-based analysis using OpenAI. Try it out [here](https://dn-scribe-ai.hf.space/viewer?cve_id=CVE-2024-9900) - `/viewer?cve_id&refresh=` → live stream report - `/cached` → raw markdown report - `/json?cve_id=&refresh=` → JSON response - `/healthz` → health check - `/raw?cve_id=&refresh=` → Returns raw markdown report content. If the report does not exist, it generates it using OpenAI. - `/cve_info?cve_id=` → Fetches CVE information as JSON with error handling. - `/ghsa_to_cve?ghsa_id=` → Converts GHSA ID to CVE ID using OpenAI. - `/report?prompt_name=&prompt_prompt=&prompt_params=<{"var1": ..."}>` → Returns raw markdown report content. If the prompt file does not exist, uses prompt_prompt instead. - `/report_json?prompt_name=&prompt_prompt=&prompt_params=<{"var1": ..."}>` → Returns JSON response. If the prompt file does not exist, uses prompt_prompt instead. Swagger available (on hugging face) [here](https://dn-scribe-ai.hf.space/docs) ## Detailed Documentation: `/report` and `/report_json` Endpoints ### Overview The `/report` and `/report_json` endpoints provide dynamic report generation using custom prompts and parameters. They support both GET (query parameters) and POST (JSON body) methods. These endpoints are designed for advanced use cases where you want to generate either Markdown or JSON reports using a specific prompt template and input parameters. --- ### Prerequisites - **Prompt Files:** - For `/report`, a Markdown prompt file named `.md` must exist in `app/prompts/`. - For `/report_json`, a JSON prompt file named `_json.md` must exist in `app/prompts/`. - If the specified prompt file does not exist, you must provide the prompt content directly via the `prompt_prompt` parameter. --- ### Input Parameters Both endpoints accept the following parameters (either as query parameters for GET or as a JSON body for POST): - `prompt_name` (string, optional): The base name of the prompt file (without extension). - For `/report`, looks for `app/prompts/.md` - For `/report_json`, looks for `app/prompts/_json.md` - `prompt_prompt` (string, optional): The prompt content to use if the prompt file is not found. - `prompt_params` (object, optional): A dictionary of variables to substitute into the prompt template. **Example JSON body:** ```json { "prompt_name": "finding", "prompt_prompt": null, "prompt_params": { "cve_id": "CVE-2024-9900", "description": "Buffer overflow in XYZ" } } ``` --- ### `/report` Endpoint - **GET** `/report?prompt_name=&prompt_prompt=&prompt_params=` - **POST** `/report` (with JSON body as above) **Returns:** A Markdown report as plain text. **Example GET:** ```bash curl -G "http://localhost:8000/report" \ --data-urlencode "prompt_name=finding" \ --data-urlencode "prompt_params={\"cve_id\":\"CVE-2024-9900\"}" ``` **Example POST:** ```bash curl -X POST "http://localhost:8000/report" \ -H "Content-Type: application/json" \ -d '{"prompt":{"name":"finding","params":{"cve_id":"CVE-2024-9900"}}' ``` --- ### `/report_json` Endpoint - **GET** `/report_json?prompt_name=&prompt_prompt=&prompt_params=` - **POST** `/report_json` (with JSON body as above) **Returns:** A JSON object with the generated report. **Example GET:** ```bash curl -G "http://localhost:8000/report_json" \ --data-urlencode "prompt_name=finding" \ --data-urlencode "prompt_params={\"cve_id\":\"CVE-2024-9900\"}" ``` **Example POST:** ```bash curl -X POST "http://localhost:8000/report_json" \ -H "Content-Type: application/json" \ -d '{"prompt":{"name":"finding","params":{"cve_id":"CVE-2024-9900"}}' ``` --- ### Output - `/report`: Returns a Markdown string. - `/report_json`: Returns a JSON object, typically with a `body` field containing the report. **Example `/report_json` response:** ```json { "body": { "cve_id": "CVE-2024-9900", "summary": "Buffer overflow in XYZ...", "severity": "High" } } ``` --- ### Error Handling - If the required prompt file is missing and no `prompt_prompt` is provided, the endpoint returns a 400 error. - If the generated output is not valid (e.g., invalid JSON for `/report_json`), a 500 error is returned with details. --- ### Summary Table | Endpoint | Method | Input Location | Output Type | Prerequisite File(s) | |------------------|--------|----------------|-------------|-------------------------------------| | `/report` | GET | Query params | Markdown | `app/prompts/.md` | | `/report` | POST | JSON body | Markdown | `app/prompts/.md` | | `/report_json` | GET | Query params | JSON | `app/prompts/_json.md` | | `/report_json` | POST | JSON body | JSON | `app/prompts/_json.md` | Example of converting GHSA to CVE: ```bash curl -X GET "http://127.0.0.1:8000/ghsa_to_cve?ghsa_id=GHSA-832w-fhmw-w4f4" -H "accept: application/json" {"ghsa_id":"GHSA-832w-fhmw-w4f4","cve_id":"CVE-2024-55890"} ``` MCP Config for VSCode: Create a file named `mcp.json` in the `.vscode` folder of your project and add the following content: ```json { "servers": { // "cve_analysis__debug": { // "type": "sse", // "url": "http://localhost:8000/mcp" // }, "cve_analysis_hf": { "type": "sse", "url": "https://dn-scribe-ai.hf.space/mcp" } } } ``` Function to convert from GHSA to CVE-ID: A function based on OpenAI gpt-4o-mini-search-preview with costs as follows: - 25$ per 1k API calls - 0.15$ per 1M input tokens - 0.60$ per 1M output tokens Since the whole transaction is about 40 tokens, the real cost is the per-api-call cost.