triageshield

Check a vulnerability report's concrete claims (file paths, file:line references, function names) against a real public GitHub repo's current contents. Flags claims that don't check out -- the file doesn't exist, the line is past EOF, the function isn't in the file -- which is the most common signature of an AI-generated fabricated vuln report. Does not judge whether a real, verifiable claim describes an actual security bug; it only checks whether the claim is honest about the codebase.

{'type': 'object', 'required': ['repo', 'report'], 'properties': {'repo': {'type': 'string', 'description': 'A github.com/owner/name URL for the public repo being reported against'}, 'report': {'type': 'string', 'description': 'The full text of the vulnerability report to check'}}}