AI-assisted vulnerability remediation. From runtime evidence to verified fix.
Anyone's agent can fix a finding; the scanner underneath is what matters. NightVision feeds the fix loop runtime evidence, and your team reviews every merge.
Findings arrive as work orders, not alerts
Dynamic finding, runtime evidence
The running application is tested; the request, response, payload, and observed behavior are captured for reproduction.
Code Traceback to file and line
On supported API scans backed by source discovery, findings can include the file and line that defined the endpoint, not only a URL.
SARIF into GitHub Security Alerts
Findings land in the repository and pull request workflow developers already live in. Jira, Slack, and Teams routing included.
Explain and reproduce
Explain with AI adds plain-language context; Validate with Curl replays the relevant request.
The scan, fix, and rescan loop for coding agents
The open-source NightVision MCP server and Agent Skills put testing inside the coding session: the agent starts a scan, inspects the evidence, locates the responsible code, proposes a change, and runs NightVision again to verify the finding is gone.
Evidence becomes a code change
Request-level findings lead the agent from the endpoint and vulnerable parameter to the actual sink; response and configuration findings point to the relevant security configuration.
Verify the behavior changed
The agent reruns the same DAST workflow and confirms the finding no longer appears; the change and scan evidence then enter your normal pull request and review process.
The review gate is the feature, not the limitation
Agents get a controlled security workflow, not authority over production. Your repository controls decide what is committed or merged, and accountability stays with the team that owns the application.
Remediation questions, answered.
Can coding agents remediate NightVision findings?
Yes. Through the NightVision MCP server and Agent Skills, a coding agent can launch a scan, inspect the evidence, follow source context where available, propose a code change, and rescan to verify the behavior changed. Your repository's normal review and merge controls still apply.
Does every finding include a source file and line?
No. Code Traceback is available for API findings when the scan uses a source-discovered OpenAPI specification. Other web, response, and configuration findings still include runtime evidence and remediation context, but the fix may live in framework or security configuration rather than the reported endpoint.
How does NightVision know the exact file and line?
Code Traceback works on API scans backed by source discovery: NightVision reads your source to map endpoints before it scans, so when the running application returns a vulnerable response on one of those endpoints, the finding resolves to a precise file and line rather than just a URL.
How do findings reach developers?
NightVision exports findings as SARIF into GitHub Security Alerts, so they appear in the repository where the code lives, alongside the pull request workflow developers already use. Findings can also flow to Jira, Slack, and Microsoft Teams.
Does NightVision bypass repository review controls?
No. The MCP server supplies scan tools and evidence to the coding agent. Repository permissions, branch protections, and review policy control what the agent may change or merge. NightVision's recommended workflow keeps a human on the merge.
Turn runtime evidence into a verified fix.
See the full loop on your own application: scan the running app, follow the evidence into the code, propose a change, and rescan before review.