Graph-based agent traces CVE blast radius and reports when no dependency path exists

Blastradius is a security agent that uses a graph database, FalkorDB, to answer whether a newly disclosed vulnerability affects a system and through which dependency chain. Instead of similarity search, it runs a shortest-path traversal from internet-facing services to the vulnerable package, returning the path, owning team and fixed version. When no path exists, the tool returns NOT_AFFECTED with the empty traversal as evidence, and verdicts are produced by rules rather than the language model. Human-approved remediation decisions are stored as Case nodes that later advisories can reuse. The project was tested on Google's Online Boutique demo using real lockfiles and OSV advisories.