Version: 1.6.1

Installing and running the AI FP service

You can install the AI FP service in one of the following ways:

installing it as part of TRON.ASOC;
installing it on separate infrastructure.

Installing and running AI FP as part of TRON.ASOC

This installation method is available when the AI FP service is included in TRON.ASOC as an optional component.

You can install it using Docker Compose or Kubernetes.

Installing with Docker Compose

To install the service with Docker Compose, follow these steps:

Uncomment the fp service in the docker-compose.yaml file.
Set the following variable values for the core service:

- ASOC_COPILOT_ENABLED=${ASOC_COPILOT_ENABLED:-true}
- FP_SERVICE_API_KEY=dev-secret-key-12345
- FP_SERVICE_BASE_URL=https://fp:8010/api/v1/

Set the following variable values for the fp service:

- SERVER_PORT=8010
- API_KEY=${FP_API_KEY:-dev-secret-key-12345}
- LLM_BASE_URL=${FP_LLM_BASE_URL:-https://api.deepseek.com/v1}
- LLM_MODEL=${FP_LLM_MODEL:-deepseek-chat}
- LLM_API_KEY=${FP_LLM_API_KEY:-sk-..}

Uncomment the following block in the nginx.conf file:

# FP service
location /fp/ {
    proxy_pass http://fp:8010/;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    client_max_body_size 100m;
}

Installing with Kubernetes

If TRON.ASOC is deployed in Kubernetes, enable the AI FP service as a system component. To do this:

Change the component block in the values.yaml file:

asoc-ai:
  enabled: true

Set the following variable values in the configmap.infraconfig file:

## FP-Provider
SERVER_PORT: 8010
API_KEY: dev-secret-key-12345
LLM_BASE_URL: https://api.deepseek.com/v1
LLM_MODEL: deepseek-chat
LLM_API_KEY: sk-..
LLM_TIMEOUT: 120s
WORKER_COUNT: 2
QUEUE_SIZE: 100
CLEANUP_INTERVAL: 5m
READ_TASK_TTL: 15m
UNREAD_TASK_TTL: 1h
LOG_LEVEL: info
 
## ASOC service
FP_SERVICE_BASE_URL: http://asoc-ai-fp:8010/api/v1
FP_SERVICE_API_KEY: dev-secret-key-12345
ASOC_COPILOT_ENABLED: true

info

The API_KEY and LLM_API_KEY values above are examples. Use your own secret data during installation.

Installing AI FP on separate infrastructure

This installation method involves deploying the vLLM and copilot-fp-service components on a separate machine and then connecting them to TRON.ASOC.

To install AI FP this way, follow these steps:

Prepare the infrastructure according to the requirements in the Technical requirements section.
Create a docker-compose.yaml file with the following configuration:

services:
  fp-service:
    image: harbor.tronsec.ru/asoc/fp:v1.4.2
    ports:
      - "8088:8080"
    environment:
      - SERVER_PORT=8080
      - API_KEY=${API_KEY:-dev-secret-key}
      - LLM_BASE_URL=http://vllm:8000/v1
      - LLM_MODEL=Qwen/Qwen2.5-3B-Instruct
      - LLM_TIMEOUT=120s
      - WORKER_COUNT=2
      - QUEUE_SIZE=100
      - CLEANUP_INTERVAL=5m
      - READ_TASK_TTL=15m
      - UNREAD_TASK_TTL=1h
      - LOG_LEVEL=info
    depends_on:
      - vllm
    networks:
      - web
  vllm:
    image: vllm/vllm-openai:latest
    ports:
      - "8089:8000"
    volumes:
      - vllm_data:/root/.cache/huggingface
    environment:
      - HF_HOME=/root/.cache/huggingface
    command: >
      --model Qwen/Qwen2.5-3B-Instruct
      --kv-cache-dtype auto
      --gpu-memory-utilization 0.7
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
networks:
  web:
    external: true
volumes:
  vllm_data:

After starting the services, set the following variable values for the asoc-back service to integrate it with TRON.ASOC:

ASOC_COPILOT_ENABLED: true
FP_SERVICE_API_KEY: dev-secret-key
FP_SERVICE_BASE_URL: https://fp-service:8080/api/v1/

Running the AI FP service

Configuring the LLM provider

The AI FP service isn't tied to a specific LLM provider and works with any OpenAI-compatible API. Set the provider with the LLM_BASE_URL and LLM_MODEL variables.

We recommend using self-hosted vLLM because it provides data privacy and better performance. If necessary, you can replace the provider, for example:

# Ollama
LLM_BASE_URL=http://localhost:11434/v1
LLM_MODEL=qwen2.5:7b-instruct
 
# OpenAI API
LLM_BASE_URL=https://api.openai.com/v1
LLM_MODEL=gpt-4o-mini
 
# Другой OpenAI-совместимый эндпоинт
LLM_BASE_URL=https://your-llm-server/v1
LLM_MODEL=your-model-name

Quick start

The following technical requirements apply:

Go 1.25 or later;
Docker and Docker Compose installed;
an NVIDIA GPU (for vLLM) and a CPU.

To start the service, follow these steps:

Clone and install the AI FP service repository:

git clone https://github.com/ximidev/tron-asoc/copilot-fp-service.git
cd copilot-fp-service
cp .env.example .env

Specify the API token for LLM access in the API_KEY variable in the .env file.
Start the services: make docker-up

info

The make docker-up command starts the following services:

fp-service (port 8080);
vllm (port 8000).

Check the service status: curl http://localhost:8080/api/v1/health

Working with the AI FP service through the API

You can perform the following actions with AI FP using API requests:

create an FP analysis task;
get the task status;
cancel the task.

Creating an FP analysis task

Method: POST /api/v1/check-fp

Request

curl -X POST http://localhost:8080/api/v1/check-fp \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "issues": [{
      "issue_id": "VUL-12345",
      "cve": "CVE-2023-1234",
      "cwe": "CWE-79",
      "severity": "HIGH",
      "title": "XSS vulnerability",
      "description": "User input not sanitized",
      "file_path": "src/app.go",
      "line_number": 42,
      "code_snippet": "fmt.Fprintf(w, userInput)",
      "context": {
        "function": "handleRequest",
        "framework": "net/http"
      }
    }]
  }'

Request headers

Parameter	Value	Description
`X-API-Key`	`your-api-key`	API key for request authentication
`Content-Type`	`application/json`	Format of the transmitted data (JSON)

Request parameters

Parameter	Type	Description
`issues`	`array[object]`	Array of objects containing vulnerability information to check

issues object fields

Parameter	Type	Description
`issue_id`	`string`	Unique vulnerability identifier in TRON.ASOC
`cve`	`string`	CVE identifier (Common Vulnerabilities and Exposures)
`cwe`	`string`	CWE identifier (Common Weakness Enumeration)
`severity`	`string`	Vulnerability severity
`title`	`string`	Short vulnerability name
`description`	`string`	Detailed description of the issue
`file_path`	`string`	Path to the file where the vulnerability was found
`line_number`	`integer`	Line number in the file
`code_snippet`	`string`	Code fragment containing the vulnerability
`context`	`object`	Additional vulnerability context

context object fields

Parameter	Type	Description
`function`	`string`	Name of the function or method where the vulnerability was found
`framework`	`string`	Framework or library in use (for example, `net/http`)

Response

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "pending",
  "created_at": "2024-11-10T12:00:00Z"
}

Response parameters

Parameter	Type	Description
`task_id`	`string` (UUID)	Unique identifier of the created task
`status`	`string`	Current task status
`created_at`	`string`	Created date and time in UTC format (for example, `2024-11-10T12:00:00Z`)

Getting the task status

Method: GET /api/v1/tasks/{task_id}

Request

curl http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-API-Key: your-api-key"

Request headers

Parameter	Value	Description
`X-API-Key`	`your-api-key`	API key for request authentication

Responses

Processing (task is being processed):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "processing",
  "progress": {
    "total": 1,
    "processed": 0,
    "failed": 0
  },
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:00:30Z"
}

Completed (task is complete):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "results": [{
    "issue_id": "VUL-12345",
    "is_false_positive": true,
    "probability": 0.92,
    "confidence": "high",
    "explanation": "Input is sanitized by middleware before reaching this code",
    "reasoning_steps": [
      "Analyzed code context",
      "Found sanitization in AuthMiddleware",
      "Confirmed output encoding"
    ]
  }],
  "progress": {"total": 1, "processed": 1, "failed": 0},
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:02:15Z",
  "completed_at": "2024-11-10T12:02:15Z"
}

Cancelled (task was cancelled):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "cancelled",
  "error": "Task cancelled by user",
  "results": [
    ...
  ],
  "progress": {"total": 5, "processed": 2, "failed": 0},
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:01:30Z",
  "completed_at": "2024-11-10T12:01:30Z"
}

Response parameters

Parameter	Type	Description
`task_id`	`string`	Task identifier
`status`	`string`	Task status (`processing`, `completed`, `cancelled`)
`progress`	`object`	Task progress
`created_at`	`string`	Created date and time
`updated_at`	`string`	Date and time of the last update
`completed_at`	`string`	Date and time of completion or cancellation
`results`	`array[object]`	Check results
`error`	`string`	Description of the cancellation reason

progress object fields

Parameter	Type	Description
`total`	`integer`	Total vulnerabilities in the task
`processed`	`integer`	Successfully processed
`failed`	`integer`	Processed with errors

results[i] object fields

Parameter	Type	Description
`issue_id`	`string`	Vulnerability identifier
`is_false_positive`	`boolean`	`true`—false positive, `false`—confirmed vulnerability
`probability`	`number`	Probability of a false positive
`confidence`	`string`	Confidence level
`explanation`	`string`	Explanation of the verdict
`reasoning_steps`	`array[string]`	Model reasoning steps

Cancelling a task

Method: DELETE http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000

Request

curl -X DELETE http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-API-Key: your-api-key"

Request headers

Parameter	Value	Required parameter	Description
`X-API-Key`	`your-api-key`	Yes	API key for request authentication

Response

{
  "message": "Task cancelled successfully",
  "task_id": "550e8400-e29b-41d4-a716-446655440000"
}

Response parameters

Parameter	Type	Description
`message`	`string`	Message about the operation result
`task_id`	`string` (UUID)	Identifier of the cancelled task

Installing and running AI FP as part of TRON.ASOC​

Installing with Docker Compose​

Installing with Kubernetes​

Installing AI FP on separate infrastructure​

Running the AI FP service​

Configuring the LLM provider

Quick start​

Working with the AI FP service through the API​

Creating an FP analysis task​

Request​

Request headers​

Request parameters​

Response​

Response parameters​

Getting the task status​

Request​

Request headers​

Responses​

Response parameters​

Cancelling a task​

Request​

Request headers​

Response​

Response parameters​

Installing and running AI FP as part of TRON.ASOC

Installing with Docker Compose

Installing with Kubernetes

Installing AI FP on separate infrastructure

Running the AI FP service

Quick start

Working with the AI FP service through the API

Creating an FP analysis task

Request

Request headers

Request parameters

Response

Response parameters

Getting the task status

Request

Request headers

Responses

Response parameters

Cancelling a task

Request

Request headers

Response

Response parameters