Security audit autofix previews

Use autofix after a security finding has been scoped to a method and, optionally, a CWE. CodeGraph generates a proposed unified diff plus validation metadata. The current CLI, REST, and MCP surfaces are read-only preview surfaces: each returns suggestions and never applies them to the working tree.

CLI: suggestions from an audit report

Run the audit against an explicit, configured CPG database:

python -m src.cli audit --db PATH --autofix --skip-llm-conclusion --skip-persistence

The audit collects security findings and passes available taint-path evidence to the dry-run autofix engine. If the report contains no usable taint paths, the command reports that no suggestions can be generated. --skip-persistence prevents audit result and snapshot persistence, but the audit freshness preflight may still update a stale CPG database.

The command prints suggestions and leaves files unchanged. Capture the output in a caller-owned location when it becomes review evidence.

REST: preview one method

The current route is POST /api/v1/security/autofix. It uses the project context selected by the API runtime.

curl -X POST http://localhost:8000/api/v1/security/autofix \
  -H "Content-Type: application/json" \
  -d '{
    "method_name": "process_query",
    "cwe": "CWE-89"
  }'

method_name selects findings for one method. cwe is an optional filter. A request with no matching findings succeeds with an empty results list and count: 0.

Do not pass an arbitrary source_path. When a source path is supplied, the route checks it against the registered project source directory and rejects paths outside that boundary.

MCP: preview for an assistant

Call the role-scoped tool with native string arguments:

codegraph_security_autofix_preview(method_name="process_query", cwe="CWE-89")

The tool resolves the runtime database internally. Agent-facing callers must not provide a raw database path.

Read the response

A generated item can include:

• file_path and line_number — proposed edit location;
• strategy and confidence — how the suggestion was generated and its confidence;
• validated — whether the generated diff passed the built-in structural validation;
• cwe_id, vulnerability_type, and severity — finding classification;
• explanation — why the change is proposed;
• diff_patch — the unified diff to review.

validated: true records the preliminary validation result for the patch. Product correctness requires compilation, focused tests, regression tests, architecture review, and AppSec approval.

Safe application workflow

1. Preserve the original finding, revision, and source evidence.
2. Perform human review of the entire diff_patch, including surrounding code and trust boundaries.
3. Reproduce the vulnerability or add a failing security test.
4. Apply the smallest accepted change through the normal development workflow.
5. Run focused and regression tests, then repeat the security check.
6. Obtain the accountable AppSec verdict before treating the finding as closed.

Reject a suggestion if it changes behavior outside the accepted scope, relies on a missing dependency, weakens validation, hides the symptom without removing the flow, or cannot be tested.

Failure and permission boundaries

• Empty results mean no preview was generated for the selected method/filter; continue the vulnerability review with the configured scope and runtime evidence.
• A path-boundary error means the requested source root is outside the registered project.
• Tool absence can be a profile or role-policy restriction. Use the active catalog and policy.
• Autofix never commits, pushes, approves, or releases a change.

Maintained source contracts

• CLI dry-run integration: src/cli/analysis_commands/audit_commands.py
• REST request, path boundary, and response: src/api/routers/security_suite/security.py
• MCP preview contract: src/mcp/tools/security_suite/security.py
• Autofix engine: src/analysis/autofix/engine.py

For the finding workflow and evidence boundary, see Security Audit.