VulnGraph Gives AI Coding Agents Offline, Deterministic Vulnerability Checks

·2 views

A developer has built VulnGraph, a security tool designed to give AI coding agents reliable, deterministic vulnerability assessments without depending on live web searches or model memory. The tool compiles upstream security sources — including CVE List V5, EPSS scores, and CISA KEV — into verified, content-addressed local snapshots that can be queried entirely offline. A key design goal is preserving meaningful distinctions between outcomes such as 'not affected,' 'unknown,' and operational errors, which standard harnesses often flatten into a simple safe-or-unsafe Boolean. Each verdict returned by VulnGraph includes a typed disposition, recommended action, confidence score, and the exact snapshot hash that produced the result, making checks reproducible across agent runs. The project is split into two components — vulngraph-data for snapshot management and vulngraph-cli for performing checks against CVEs, package versions, or full lockfiles.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Fix GBase 8a Metadata Loss After Unclean Cluster Shutdown

A sudden power loss or kernel panic in a GBase 8a cluster can prevent in-memory metadata from being written to disk, leaving the gbase.table_distribution system table with missing rows. This causes queries to fail with error GBA-02SC-1001, while the affected table enters a contradictory state where it can neither be dropped nor recreated. The recommended recovery method is to manually insert the missing metadata row directly into gbase.table_distribution, then restart the gcluster service for changes to take effect. Administrators can also identify all affected tables using an information_schema query, or restore data files from a healthy standby cluster if one is available. To prevent recurrence, experts advise maintaining regular backups of the table_distribution table and avoiding abrupt cluster shutdowns wherever possible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source LLMs Match Closed Models in 2026: Nine Best Options Ranked

Open-source large language models have reached performance parity with leading closed models in 2026, with Moonshot AI's Kimi K3 tying Claude Opus 4.8 and GPT-5.5 on the Artificial Analysis Intelligence Index. The 2.8-trillion-parameter model supports up to 1 million tokens of context and has been available via hosted API since July 16, though downloadable weights are expected only by July 27, 2026. Z.ai's GLM-5.2, MIT-licensed and available on Hugging Face, held the top open-model ranking before K3 and remains competitive at significantly lower per-token pricing. DeepSeek's MoE architecture offers frontier-class capabilities at under one dollar per million output tokens, making it attractive for high-volume production use. Across the nine ranked models, factors such as license terms, context window size, hardware requirements, and token pricing vary widely, giving developers a broad range of options depending on cost and capability needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Run Kimi K3 in Claude Code, Cursor, and Cline via LLM Gateway

Kimi K3, which topped Arena's Frontend Code evaluation at launch and supports a 1M-token context, is not natively available in popular coding agents like Claude Code, Cursor, or Cline. LLM Gateway solves this by acting as a middleware that speaks both Anthropic and OpenAI API formats, letting developers route requests to Kimi K3 with a simple base-URL change. In Claude Code, three environment variables redirect traffic to the gateway; in Cursor, the model can be added via the custom OpenAI-compatible endpoint settings, though only the chat and plan panels are supported. Cline offers the most complete integration, running its full agent loop — including file edits and terminal commands — on K3 after configuring the provider details in VS Code. LLM Gateway offers both a flat-rate DevPass subscription and pay-as-you-go credits priced at Moonshot's published rates plus a 5% platform fee.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kimi K3 Rivals Claude Opus 4.8 on Benchmarks at 40% Lower Cost

Moonshot AI's Kimi K3, released just days ago, has ranked fourth out of 189 models on the Artificial Analysis Intelligence Index, placing it statistically level with Anthropic's Claude Opus 4.8 and OpenAI's GPT-5.5. In head-to-head benchmark comparisons, the two models are virtually tied on graduate-level reasoning, while K3 leads on agentic terminal tasks and ranked first in Arena's blind frontend code evaluation. Pricing favors K3 significantly, with input and output tokens costing 40% less than Opus 4.8, translating to roughly $600 versus $1,000 per month on a typical coding-agent workload. However, Claude Opus 4.8 retains advantages in production-validated software engineering benchmarks, configurable reasoning effort, and a mature ecosystem of agent tooling built around Anthropic's models. K3's open weights are expected to be released by July 27, making it a compelling option for teams prioritizing cost, frontend code generation, or self-hosting flexibility.

0 comments Read more at DEV Community