Agent-ready workflow · server
File and Parser Lifecycle
Trace upload, validation, transformation, storage, preview, download, and deletion through each parser boundary.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- upload
- import
- archive
- image conversion
- document preview
Prerequisites
- controlled files
- cleanup path
- allowed content types
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Map the file lifecycle
Record every filename, content type, magic-byte, metadata, storage, transformation, and serving boundary.
Inputs
- benign control files
Outputs
- parser and storage map
- Evidence gate
- Each transformation has an observed input and output artifact.
- Negative control
- Rejected type and malformed but inert file behavior are recorded.
- Stop condition
- Do not upload active content before locating the sink.
Vary one parser property
Change extension, MIME, magic bytes, metadata, archive path, encoding, or dimensions one at a time.
Inputs
- paired inert files
Outputs
- parser matrix
- Evidence gate
- The property responsible for different handling is isolated.
- Negative control
- An otherwise identical clean file establishes normal behavior.
- Stop condition
- No decompression bombs, parser crashes, or oversized files.
Observe serving and rendering
Record origin, content type, disposition, CSP, isolation, and which user or service can view the artifact.
Inputs
- processed artifact
Outputs
- delivery boundary evidence
- Evidence gate
- Execution, inline rendering, and download are distinguished.
- Negative control
- The clean control is served under the same policy.
- Stop condition
- No content delivered to uncontrolled viewers.
Clean up and report the primitive
Delete artifacts and state only the demonstrated read, write, traversal, render, or execution behavior.
Inputs
- paired evidence
Outputs
- cleanup record
- minimal report
- Evidence gate
- The report does not collapse parser acceptance into execution.
- Negative control
- Deletion or expiry is verified when possible.
- Stop condition
- No persistence beyond owned test records.
Related methods
Continue with the right depth.
Sources