What it is
Single-file Python scorer for AI-agent security findings: feed a JSON or Markdown report and get is_vulnerability, impactful, and an impact_score in [0, 1] back, importable by another agent.
What it does: Requires title / description / exploitation steps / impact; optional evidence and context; rejects unknown fields; ships positive and negative synthetic examples (IDOR, blind SSRF, stored XSS, self-XSS, backported-fix banner, authorized role change).
Why it belongs in the showcase: A compact confidence-gated triage shape — score first, act only when impact is clear — with honest synthetic labeling.
Caveats: Synthetic findings only; no license file at intake; sends report text to the hosted model.
Evidence
Public README; strict JSON input (unknown fields rejected); seven synthetic example findings with reference labels kept outside the report JSON so Jev is never shown the answer.
Caveats
- All included findings are synthetic (per README); reference labels are not measured model results
- No license file detected on the repo at intake
- Hosted Jev sees the full finding text — check disclosure policy before sending real reports
Unofficial case page. Stars / list position observed for heat; do not treat heat as a quality SLA. Review the upstream README before you depend on it.