🚨 Remediation Intelligence Platform

From dependency alerts to confident fixes.

ThreatGraph scans GitHub repositories, matches dependencies to vulnerability intelligence, recommends safe upgrade versions, and creates GitHub issues automatically when a confident remediation exists.

Get Early Access See How It Works For Agents →

The Problem

Finding vulnerabilities is easy. Fixing them is not.

Your team doesn't need more alerts. It needs remediation intelligence.

✘
Alert fatigue
Scanners produce noise — teams drown in alerts with no clear actions.
✘
Manual research
Remediation research is manual and slow — "what version do I upgrade to?"
✘
Stalled fixes
Dependency fixes stall because "what version?" isn't answered.
✘
Shallow integration
GitHub workflow integration is often shallow or bolt-on.

How It Works

Six steps from repo to remediation

Every scan flows through a structured pipeline — deterministic first, AI only when needed.

Connect GitHub Repo

Detect Dependency Versions

Ingestor parses manifests and lockfiles across all ecosystems.

Match to Vulnerability Intelligence

Maps packages to GHSA, OSV, and NVD advisories in priority order.

Determine If Version Is Affected

Structured range matching against affected and patched version ranges.

Recommend Minimum Safe Version

Computes exact upgrade target with confidence scoring.

Create GitHub Issues

Auto-creates issues when confidence ≥ 90, with full rationale.

Why ThreatGraph

Outcomes, not just outputs

Every feature is designed to reduce time-to-remediation.

🎯

Know what is actually actionable

Not all vulnerabilities have fixes. See only what your team can act on — skip the noise.

⬆

Get recommended upgrade targets

"Upgrade lodash from 4.17.20 to 4.17.21 — confidence: 95." Specific, actionable, trustworthy.

🤖

Automate GitHub issues with confidence

Auto-create at 90+. Flag for review at 75–89. Skip below 75. You control the threshold.

⚡

Reduce remediation research overhead

Package-native advisory matching means less manual version research per vulnerability.

🛡

Keep humans in control

Confidence scoring and recommendation types create clear review signals. Humans decide, machines execute.

🤝

One workflow for security + engineering

A single remediation pipeline serves both teams. No more ticketing bounces.

Comparison

ThreatGraph vs. generic scanners

Dimension	Generic Scanners	ThreatGraph
Focus	Detection	Remediation
Output	CVE lists	Version-specific upgrade recommendations
Automation	Alerting	Confidence-gated GitHub issue creation
Data strategy	NVD/AI-first	Package-native first, AI only for edge cases
Interfaces	Human dashboard	API + CLI + Agent Skill
Agent support	None	Agent-first architecture

Proof

See what ThreatGraph produces

Real-looking artifacts from the remediation pipeline.

recommendation.json
{
  "package": "lodash",
  "ecosystem": "npm",
  "current_version": "4.17.20",
  "minimum_safe_version": "4.17.21",
  "preferred_version": "4.17.21",
  "confidence_score": 95,
  "recommendation_type": "structured",
  "breaking_change_risk": "low",
  "advisory": "GHSA-35jh-r3h4-6jhm",
  "severity": "critical",
  "actionable": true}

$ threatgraph findings list

# ThreatGraph CLI — Findings Report CRITICAL [email protected] → Upgrade to 4.17.21 (confidence: 95) Advisory: GHSA-35jh-r3h4-6jhm Risk: Prototype Pollution Issue: #42 created HIGH [email protected] → Upgrade to 4.18.2 (confidence: 88) Advisory: GHSA-rv95-896h-c2vc Risk: Open Redirect Issue: flagged for review MEDIUM [email protected] → Upgrade to 0.21.4 (confidence: 92) Advisory: GHSA-42xw-2xvc-qx8m Risk: SSRF Issue: #43 created

For AI Agents

Humans buy platforms their agents can actually use.

The same remediation intelligence that powers the dashboard also powers autonomous agent workflows — through API, CLI, and skill interfaces.

Explore the Agent Workflow →

📡REST API with structured JSON responses for all endpoints
💻CLI for scripting and pipeline integration
🧩Agent Skill interface for autonomous orchestration
🔄Onboard repos, trigger scans, read findings — all programmatic
🔒Same confidence scoring governs both human and agent actions

FAQ

Common questions

How is ThreatGraph different from vulnerability scanners?▼

Most scanners stop at detection — they tell you what's vulnerable. ThreatGraph is remediation-first: it tells you what version to upgrade to, with confidence scores. Scanning is a step. Remediation is the product.

Does ThreatGraph recommend safe versions automatically?▼

Yes. ThreatGraph uses deterministic matching against the GitHub Advisory Database and OSV to compute the minimum safe version and preferred upgrade target, with a confidence score. AI is only used for ambiguous edge cases.

Does it create GitHub issues?▼

Yes — when the confidence score meets your configured threshold (default 90+), ThreatGraph creates a GitHub issue with the recommendation, affected range, safe version, and rationale. Duplicates are automatically de-duped.

Is AI required for every recommendation?▼

No. AI is the fallback, not the default. The design principle is: deterministic first, agentic second, AI third. Most recommendations are fully structured and rule-based. AI (Claude) is only invoked for prose-only advisories or conflicting data.

Can teams review recommendations before automation?▼

Absolutely. Confidence tiers control automation: 90+ auto-creates issues, 75–89 flags for human review, below 75 is informational only. Your team stays in control.

How does the agent workflow work?▼

ThreatGraph exposes its entire pipeline through a REST API, CLI, and agent skill interface. Autonomous agents can onboard repos, trigger scans, read findings, and create issues — all through structured JSON.