Agent-ready workflow · server

File and Parser Lifecycle

Trace upload, validation, transformation, storage, preview, download, and deletion through each parser boundary.

file-uploadparserarchiveimagedocument
Stable IDworkflow:file-parser-lifecycleSource record dateHuman reviewNot recordedProvenanceCurated workflow graph

Enter with artifacts, leave with evidence.

Use when
  • upload
  • import
  • archive
  • image conversion
  • document preview
Prerequisites
  • controlled files
  • cleanup path
  • allowed content types
MCP retrieval

Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.

01

Map the file lifecycle

Record every filename, content type, magic-byte, metadata, storage, transformation, and serving boundary.

Inputs
  • benign control files
Outputs
  • parser and storage map
Evidence gate
Each transformation has an observed input and output artifact.
Negative control
Rejected type and malformed but inert file behavior are recorded.
Stop condition
Do not upload active content before locating the sink.
02

Vary one parser property

Change extension, MIME, magic bytes, metadata, archive path, encoding, or dimensions one at a time.

Inputs
  • paired inert files
Outputs
  • parser matrix
Evidence gate
The property responsible for different handling is isolated.
Negative control
An otherwise identical clean file establishes normal behavior.
Stop condition
No decompression bombs, parser crashes, or oversized files.
03

Observe serving and rendering

Record origin, content type, disposition, CSP, isolation, and which user or service can view the artifact.

Inputs
  • processed artifact
Outputs
  • delivery boundary evidence
Evidence gate
Execution, inline rendering, and download are distinguished.
Negative control
The clean control is served under the same policy.
Stop condition
No content delivered to uncontrolled viewers.
04

Clean up and report the primitive

Delete artifacts and state only the demonstrated read, write, traversal, render, or execution behavior.

Inputs
  • paired evidence
Outputs
  • cleanup record
  • minimal report
Evidence gate
The report does not collapse parser acceptance into execution.
Negative control
Deletion or expiry is verified when possible.
Stop condition
No persistence beyond owned test records.

Continue with the right depth.

References