Skip to main content

Security audit autofix previews

Generate security patch previews with CodeGraph. Review finding scope and patch limitations before applying changes and checking the result.

User Guides

Use autofix to prepare a patch suggestion for a security finding in one method; filter by CWE when needed. CodeGraph returns a unified diff and validation metadata. The preview is read-only and never applies the diff to source files. The CLI audit can update the configured CPG and save audit data, as described below.

CLI: suggestions from an audit report

Run the command in PowerShell from the CodeGraph source repository root with its Python environment installed. Replace PATH with the registered CPG (code property graph) database path; quote the path if it contains spaces. The database must be bound to the intended project and an existing source directory. For environment setup, see the CLI guide. For the project database, see Project import.

python -m src.cli audit --db PATH --autofix --skip-llm-conclusion

The audit collects security findings and passes available taint-path evidence to the dry-run autofix engine. If the report contains no usable taint paths, the command reports that it cannot generate suggestions. The --autofix and --skip-persistence flags cannot be used together; the CLI returns exit code 1 before starting the audit. With --autofix, the audit can refresh the configured CPG and save audit projections and snapshots, while leaving repository source files unchanged. Run it in the authorized workflow for that project.

Save standard output to a caller-owned file when you need a review artifact.

REST: preview one method

The current route is POST /api/v1/security/autofix. It uses the project context selected by the API runtime.

Run the example in Bash with curl 7.76 or later and a running local API whose project context points to the intended CPG. Configure the deployment-required authentication before the request; the example does not supply credentials. Replace process_query with a method from that project. For a remote API, use its approved HTTPS address. Check the HTTP status and response body.

curl --fail-with-body -X POST http://localhost:8000/api/v1/security/autofix \
  -H "Content-Type: application/json" \
  -d '{
    "method_name": "process_query",
    "cwe": "CWE-89"
  }'

method_name selects findings for one method. cwe is an optional filter. A request with no matching findings succeeds with an empty results list and count: 0. This example leaves source_path unset, so the API uses the source root from the selected project context.

MCP: preview for an assistant

The CodeGraph AppSec read role exposes this tool. In Codex, select the profile codex:role:codegraph_appsec:read. Call the tool with native string arguments:

codegraph_security_autofix_preview(method_name="process_query", cwe="CWE-89")

The tool resolves the runtime database internally. Agent-facing callers must not provide a raw database path.

MCP returns suggestions in fixes; REST uses results. Both interfaces select scanner findings by method and CWE filter and use their locations to prepare suggestions. Before applying a patch, trace data from the input to the dangerous operation using the source and dataflow analysis results.

Read the response

A generated item can include:

  • file_path and line_number — proposed edit location;
  • strategy and confidence — how the suggestion was generated and its confidence;
  • validated — whether the generated diff passed the built-in structural validation;
  • cwe_id, vulnerability_type, and severity — finding classification;
  • explanation — why the change is proposed;
  • diff_patch — the unified diff to review.

validated: true records the preliminary validation result for the patch. Before applying it, complete human review, compilation, focused and regression tests, architecture review, and AppSec approval.

Safe application workflow

  1. Preserve the original finding, revision, and source evidence.
  2. Review the entire diff_patch manually, including surrounding code and trust boundaries.
  3. Reproduce the vulnerability or add a failing security test.
  4. Apply the smallest accepted change through the normal development workflow.
  5. Run focused and regression tests, then repeat the security check.
  6. Obtain the accountable AppSec verdict before treating the finding as closed.

Reject a suggestion if it changes behavior outside the accepted scope, relies on a missing dependency, weakens validation, hides the symptom without removing the flow, or cannot be tested.

Failure and permission boundaries

  • Empty results mean no preview was generated for the selected method/filter; continue the vulnerability review with the configured scope and runtime evidence.
  • If source resolution fails, check that the API selected the intended project context.
  • If the tool is missing, check its availability and invocation rules in the active profile catalog.
  • Autofix returns a diff for review. Applying and releasing a change happen in a separate workflow.

For the finding workflow and evidence boundary, see Security Audit.

Report a documentation issue