Version: 1.7

Installing and running the AI FP service

You can install the AI FP service in one of the following ways:

installing it as part of TRON.ASOC;
installing it on separate infrastructure.

Installing and running AI FP as part of TRON.ASOC

You can use this installation method if TRON.ASOC includes the AI FP service as an optional component.

You can install it using Docker Compose or Kubernetes.

Installing with Docker Compose

To install the service with Docker Compose, follow these steps:

Uncomment the fp service in the docker-compose.yaml file.
Set the following variable values for the core service:

- ASOC_COPILOT_ENABLED=${ASOC_COPILOT_ENABLED:-true}
- FP_SERVICE_API_KEY=dev-secret-key-12345
- FP_SERVICE_BASE_URL=https://fp:8010/api/v1/

Set the following variable values for the fp service:

- SERVER_PORT=8010
- API_KEY=${FP_API_KEY:-dev-secret-key-12345}
- LLM_BASE_URL=${FP_LLM_BASE_URL:-https://api.deepseek.com/v1}
- LLM_MODEL=${FP_LLM_MODEL:-deepseek-chat}
- LLM_API_KEY=${FP_LLM_API_KEY:-sk-..}

Uncomment the following block in the nginx.conf file:

# FP service
location /fp/ {
    proxy_pass http://fp:8010/;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    client_max_body_size 100m;
}

Installing with Kubernetes

If you deployed TRON.ASOC in Kubernetes, enable the AI FP service as a system component. To do this:

Modify the component block in the values.yaml file:

asoc-ai:
  enabled: true

Set the following variable values in the configmap.infraconfig file:

## FP-Provider
SERVER_PORT: 8010
API_KEY: dev-secret-key-12345
LLM_BASE_URL: https://api.deepseek.com/v1
LLM_MODEL: deepseek-chat
LLM_API_KEY: sk-..
LLM_TIMEOUT: 120s
WORKER_COUNT: 2
QUEUE_SIZE: 100
CLEANUP_INTERVAL: 5m
READ_TASK_TTL: 15m
UNREAD_TASK_TTL: 1h
LOG_LEVEL: info
 
## ASOC service
FP_SERVICE_BASE_URL: http://asoc-ai-fp:8010/api/v1
FP_SERVICE_API_KEY: dev-secret-key-12345
ASOC_COPILOT_ENABLED: true

info

The API_KEY and LLM_API_KEY values above are examples. Use your own secrets during installation.

Installing AI FP on separate infrastructure

This method deploys the vLLM and copilot-fp-service components on a separate machine and then connects them to TRON.ASOC.

To install AI FP this way, follow these steps:

Prepare the infrastructure according to the requirements in the Technical requirements section.
Create a docker-compose.yaml file with the following configuration:

services:
  fp-service:
    image: harbor.tronsec.ru/asoc/fp:v1.4.2
    ports:
      - "8088:8080"
    environment:
      - SERVER_PORT=8080
      - API_KEY=${API_KEY:-dev-secret-key}
      - LLM_BASE_URL=http://vllm:8000/v1
      - LLM_MODEL=Qwen/Qwen2.5-3B-Instruct
      - LLM_TIMEOUT=120s
      - WORKER_COUNT=2
      - QUEUE_SIZE=100
      - CLEANUP_INTERVAL=5m
      - READ_TASK_TTL=15m
      - UNREAD_TASK_TTL=1h
      - LOG_LEVEL=info
    depends_on:
      - vllm
    networks:
      - web
  vllm:
    image: vllm/vllm-openai:latest
    ports:
      - "8089:8000"
    volumes:
      - vllm_data:/root/.cache/huggingface
    environment:
      - HF_HOME=/root/.cache/huggingface
    command: >
      --model Qwen/Qwen2.5-3B-Instruct
      --kv-cache-dtype auto
      --gpu-memory-utilization 0.7
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
networks:
  web:
    external: true
volumes:
  vllm_data:

After you start the services, set the following variable values for the asoc-back service to integrate it with TRON.ASOC:

ASOC_COPILOT_ENABLED: true
FP_SERVICE_API_KEY: dev-secret-key
FP_SERVICE_BASE_URL: https://fp-service:8080/api/v1/

Running the AI FP service

Configuring the LLM provider

The AI FP service isn't tied to a specific LLM provider. It works with any OpenAI-compatible API. Set the provider with the LLM_BASE_URL and LLM_MODEL variables.

We recommend using self-hosted vLLM because it provides data privacy and better performance. If necessary, you can replace the provider, for example:

# Ollama
LLM_BASE_URL=http://localhost:11434/v1
LLM_MODEL=qwen2.5:7b-instruct
 
# OpenAI API
LLM_BASE_URL=https://api.openai.com/v1
LLM_MODEL=gpt-4o-mini
 
# Другой OpenAI-совместимый эндпоинт
LLM_BASE_URL=https://your-llm-server/v1
LLM_MODEL=your-model-name

Quick start

The following technical requirements apply:

Go version 1.25 or later;
Docker and Docker Compose installed;
an NVIDIA GPU (for vLLM) and a CPU.

To start the service, follow these steps:

Clone and install the AI FP service repository:

git clone https://github.com/ximidev/tron-asoc/copilot-fp-service.git
cd copilot-fp-service
cp .env.example .env

Specify the API token for accessing the LLM in the API_KEY variable in the .env file.
Start the services: make docker-up

info

The make docker-up command starts the following services:

fp-service (port 8080);
vllm (port 8000).

Check the service status: curl http://localhost:8080/api/v1/health

Working with the AI FP service through the API

You can perform the following actions with AI FP using API requests:

create an FP analysis task;
get the task status;
cancel the task.

Creating an FP analysis task

Method: POST /api/v1/check-fp

Request

curl -X POST http://localhost:8080/api/v1/check-fp \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "issues": [{
      "issue_id": "VUL-12345",
      "cve": "CVE-2023-1234",
      "cwe": "CWE-79",
      "severity": "HIGH",
      "title": "XSS vulnerability",
      "description": "User input not sanitized",
      "file_path": "src/app.go",
      "line_number": 42,
      "code_snippet": "fmt.Fprintf(w, userInput)",
      "context": {
        "function": "handleRequest",
        "framework": "net/http"
      }
    }]
  }'

Request headers

Parameter	Value	Description
`X-API-Key`	`your-api-key`	API key for request authentication
`Content-Type`	`application/json`	Format of the transmitted data (JSON)

Request parameters

Parameter	Type	Description
`issues`	`array[object]`	Array of objects with vulnerability information to check

Fields in the issues object

Parameter	Type	Description
`issue_id`	`string`	Unique vulnerability identifier in TRON.ASOC
`cve`	`string`	CVE identifier (Common Vulnerabilities and Exposures)
`cwe`	`string`	CWE identifier (Common Weakness Enumeration)
`severity`	`string`	Vulnerability severity
`title`	`string`	Short vulnerability title
`description`	`string`	Detailed description of the issue
`file_path`	`string`	Path to the file where the vulnerability was detected
`line_number`	`integer`	Line number in the file
`code_snippet`	`string`	Code snippet containing the vulnerability
`context`	`object`	Additional vulnerability context

Fields in the context object

Parameter	Type	Description
`function`	`string`	Name of the function or method where the vulnerability was detected
`framework`	`string`	Framework or library in use (for example, `net/http`)

Response

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "pending",
  "created_at": "2024-11-10T12:00:00Z"
}

Response parameters

Parameter	Type	Description
`task_id`	`string` (UUID)	Unique identifier of the created task
`status`	`string`	Current task status
`created_at`	`string`	Date and time the task was created in UTC (for example, `2024-11-10T12:00:00Z`)

Getting the task status

Method: GET /api/v1/tasks/{task_id}

Request

curl http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-API-Key: your-api-key"

Request headers

Parameter	Value	Description
`X-API-Key`	`your-api-key`	API key for request authentication

Responses

Processing (task in progress):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "processing",
  "progress": {
    "total": 1,
    "processed": 0,
    "failed": 0
  },
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:00:30Z"
}

Completed (task completed):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "completed",
  "results": [{
    "issue_id": "VUL-12345",
    "is_false_positive": true,
    "probability": 0.92,
    "confidence": "high",
    "explanation": "Input is sanitized by middleware before reaching this code",
    "reasoning_steps": [
      "Analyzed code context",
      "Found sanitization in AuthMiddleware",
      "Confirmed output encoding"
    ]
  }],
  "progress": {"total": 1, "processed": 1, "failed": 0},
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:02:15Z",
  "completed_at": "2024-11-10T12:02:15Z"
}

Cancelled (task cancelled):

{
  "task_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "cancelled",
  "error": "Task cancelled by user",
  "results": [
    ...
  ],
  "progress": {"total": 5, "processed": 2, "failed": 0},
  "created_at": "2024-11-10T12:00:00Z",
  "updated_at": "2024-11-10T12:01:30Z",
  "completed_at": "2024-11-10T12:01:30Z"
}

Response parameters

Parameter	Type	Description
`task_id`	`string`	Task identifier
`status`	`string`	Task status (`processing`, `completed`, `cancelled`)
`progress`	`object`	Task progress
`created_at`	`string`	Date and time created
`updated_at`	`string`	Date and time of the last update
`completed_at`	`string`	Date and time completed or cancelled
`results`	`array[object]`	Check results
`error`	`string`	Description of the cancellation reason

Fields in the progress object

Parameter	Type	Description
`total`	`integer`	Total vulnerabilities in the task
`processed`	`integer`	Successfully processed
`failed`	`integer`	Processed with an error

Fields in the results[i] object

Parameter	Type	Description
`issue_id`	`string`	Vulnerability identifier
`is_false_positive`	`boolean`	`true`—false positive, `false`—confirmed vulnerability
`probability`	`number`	Probability of a false positive
`confidence`	`string`	Confidence level
`explanation`	`string`	Explanation of the verdict
`reasoning_steps`	`array[string]`	Model reasoning steps

Cancelling a task

Method: DELETE http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000

Request

curl -X DELETE http://localhost:8080/api/v1/tasks/550e8400-e29b-41d4-a716-446655440000 \
  -H "X-API-Key: your-api-key"

Request headers

Parameter	Value	Required	Description
`X-API-Key`	`your-api-key`	Yes	API key for request authentication

Response

{
  "message": "Task cancelled successfully",
  "task_id": "550e8400-e29b-41d4-a716-446655440000"
}

Response parameters

Parameter	Type	Description
`message`	`string`	Message about the operation result
`task_id`	`string` (UUID)	Identifier of the cancelled task

Installing and running AI FP as part of TRON.ASOC​

Installing with Docker Compose​

Installing with Kubernetes​

Installing AI FP on separate infrastructure​

Running the AI FP service​

Configuring the LLM provider

Quick start​

Working with the AI FP service through the API​

Creating an FP analysis task​

Request​

Request headers​

Request parameters​

Response​

Response parameters​

Getting the task status​

Request​

Request headers​

Responses​

Response parameters​

Cancelling a task​

Request​

Request headers​

Response​

Response parameters​

Installing and running AI FP as part of TRON.ASOC

Installing with Docker Compose

Installing with Kubernetes

Installing AI FP on separate infrastructure

Running the AI FP service

Quick start

Working with the AI FP service through the API

Creating an FP analysis task

Request

Request headers

Request parameters

Response

Response parameters

Getting the task status

Request

Request headers

Responses

Response parameters

Cancelling a task

Request

Request headers

Response

Response parameters