AI-assisted vulnerability remediation. An agent drafts the fix, a rescan proves it, your team approves it.
Anyone's agent can fix a finding; the scanner underneath is what matters. NightVision feeds the fix loop runtime evidence.
A finding that becomes a ticket becomes technical debt
Testing is rarely the bottleneck. What happens after the finding is.
The queue outgrows the team
A test finds an issue, a ticket is opened, and the ticket joins a queue already longer than the team can work. The lifecycle ends at the ticket, and the backlog becomes the record of what never got fixed.
The finding carries its own fix
The finding arrives with the full request, the response, and a curl command that reproduces it. Your agent reads that evidence over MCP, proposes the fix, and reruns the scan to verify it. Your engineer approves the merge.
Findings arrive as work orders, not alerts
Dynamic finding, runtime evidence
The running application is tested; the request, response, payload, and observed behavior are captured for reproduction.
Code Traceback to file and line
On supported API scans backed by source intelligence, findings can include the file and line that defined the endpoint, not only a URL.
SARIF into GitHub Security Alerts
Findings land in the repository and pull request workflow developers already live in. Jira, Slack, and Teams routing included.
Explain and reproduce
Explain with AI adds plain-language context; Validate with Curl replays the relevant request.
Why the evidence matters: what a DAST finding must carry for an agent to fix it.
Fix it, prove it, carry it forward.
The public NightVision MCP server and open-source Agent Skills put testing inside the coding session: the agent starts a scan, inspects the evidence, locates the responsible code, proposes a change, and runs NightVision again to verify the finding is gone.
Evidence becomes a code change
Request-level findings lead the agent from the endpoint and vulnerable parameter to the actual sink; response and configuration findings point to the relevant security configuration.
Verify the behavior changed
The agent reruns the same DAST workflow; the comparison report shows what is fixed, what is new and what is still open. The change and scan evidence then enter your normal pull request and review process.
Carry it forward
Mark a finding false positive or won't fix once in the NightVision web app. It stays suppressed in future scans of that app, matched by check, path, method and parameter. Findings you mark resolved are not suppressed, so a regression still shows up. DAST false positives that stay suppressed →
The review gate is the feature, not the limitation
Agents get a controlled security workflow, not authority over production. Your repository controls decide what is committed or merged, and accountability stays with the team that owns the application. For the wider picture, read how coding agents change application security testing.
Remediation questions, answered.
Can coding agents remediate NightVision findings?
Yes. Through the NightVision MCP server and Agent Skills, a coding agent can launch a scan, inspect the evidence, follow source context where available, propose a code change, and rescan to verify the behavior changed. Your repository's normal review and merge controls still apply.
Does every finding include a source file and line?
No. Code Traceback is available for API findings when the scan uses a source-intelligence OpenAPI specification. Other web, response, and configuration findings still include runtime evidence and remediation context, but the fix may live in framework or security configuration rather than the reported endpoint.
How does NightVision know the exact file and line?
Code Traceback works on API scans backed by source intelligence: NightVision reads your source to map endpoints before it scans, so when the running application returns a vulnerable response on one of those endpoints, the finding resolves to a precise file and line rather than just a URL.
How do findings reach developers?
NightVision exports findings as SARIF into GitHub Security Alerts, so they appear in the repository where the code lives, alongside the pull request workflow developers already use. Findings can also flow to Jira, Slack, and Microsoft Teams.
Does NightVision bypass repository review controls?
No. The MCP server supplies scan tools and evidence to the coding agent. Repository permissions, branch protections, and review policy control what the agent may change or merge. NightVision's recommended workflow keeps a human on the merge.
Will a false positive I dismiss come back on the next scan?
No. When you mark a finding false positive or won't fix in the NightVision web app, NightVision carries that triage forward for that app, so the same finding on the same endpoint does not come back as a new open finding. Findings marked resolved are not suppressed, so a regression still appears.
Turn runtime evidence into a verified fix.
See the full loop on your own application: scan the running app, follow the evidence into the code, propose a change, and rescan before review.