Appearance
Glossary
Plain meanings of the words used in the app, the API and MCP. More context: Concepts.
| Term | Meaning |
|---|---|
| Profile | A named fleet: the repositories and branches a run scans. |
| Run | One scan of a profile. Answers come from the latest finished run. |
| Advisory | A published vulnerability, identified by a CVE or GHSA id. |
| Exposure | One advisory reaching one service. |
| Edit site | The repository, file and line to change. Left blank when the evidence is not there. |
| Start-here | The ranked list of the most useful edits to make first: the package, the file to change and how many services it helps. It feeds the plan. |
| Plan | The remediation plan for one run: a ranked list of steps (usually one PR or image rebuild each) and the order they depend on each other. |
| Step rank #N | A step's position in the plan. #1 is ranked first. Ranks are stable for a run, so "step #12" means the same step in the app, the files, the API and MCP. |
| Waits on | The steps that must be merged before a step can start. |
| Wave | A column of the plan graph. Start now is the first wave (nothing to wait for); Wave 2 starts after the steps it waits on are merged, and so on. |
| Decide | A flag on a step when no fixed version is published. A person chooses: replace the package, mitigate, or accept the risk. |
| MStF (Minimal Severity to Fix) | The lowest severity you have decided must be fixed. It sets which Decide steps block, and so the fixable and blocked counts. CRITICAL means only critical; HIGH means critical plus high; and so on down. In the app it is Fix from. |
| Blocker | A Decide step whose severity is inside the chosen MStF. Shown in red and first in the work order. |
| Work order | The order to do the steps for one MStF: blockers that unblock the most first, always respecting Waits on. |
| Sketch | A PR sketch: the proposed change for each step, in work order for one MStF, so a person or an agent can apply the steps top to bottom. |
| Decision / status | Progress recorded on a step: the chosen Decide option, or in_progress, pr_opened, pr_merged, pr_closed, skipped. |
| API key | A vg_live_… token for scripts and agents, limited by scopes, optional profiles and an expiry. |
| Scope | A permission on a key, such as findings:read or decisions:write. |
| MCP | Model Context Protocol: the standard way AI agents call tools. VulnGraph's MCP endpoint is /v1/mcp. |
| Tool | One MCP operation, such as portfolio_summary or set_step_status. Each tool is one API endpoint. |
data_as_of | When the scan data behind an answer was produced. Quote numbers "as of" this time. |
MStF versus the severity filter
They are separate controls. MStF changes what counts as a blocker and the fixable and blocked numbers. The severity filter only hides or shows rows on screen; it does not change blockers or the work order.