Agent-ready workflow · evidence
Report Evidence Validation
Independently reproduce the smallest claim, remove unsupported escalation, and package paired evidence with current scope.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- candidate finding
- chain claim
- callback event
- severity disagreement
- submission ready
Prerequisites
- current scope
- raw evidence
- controlled reproduction state
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Split facts from inferences
List observation, reproduced capability, demonstrated impact, inferred impact, and untested chain edges separately.
Inputs
- candidate report
- raw artifacts
Outputs
- claim table
- Evidence gate
- Every factual sentence points to an artifact or source.
- Negative control
- Unsupported adjectives and severity claims are removed.
- Stop condition
- Do not validate on stale or out-of-scope assets.
Replay the smallest claim
Use fresh identifiers and the minimum steps needed to reproduce the boundary failure.
Inputs
- numbered reproduction
- controlled records
Outputs
- independent replay evidence
- Evidence gate
- A second clean run reproduces the same primitive.
- Negative control
- Known-good and expected-deny controls are captured.
- Stop condition
- Stop if replay risks broader impact.
Attack the confounders
Check caching, collaboration, public data, stale sessions, scanners, retries, race timing, client-only behavior, and intended functionality.
Inputs
- replay evidence
Outputs
- confounder log
- Evidence gate
- Cheaper explanations are rejected with evidence, not assertion.
- Negative control
- At least one control directly tests the leading confounder.
- Stop condition
- Reject the finding if the normal explanation fits better.
Build the submission packet
Write scope, prerequisites, steps, paired artifacts, observed vs expected, minimal impact, severity rationale, cleanup, and source links.
Inputs
- validated claim table
Outputs
- redacted report packet
- Evidence gate
- A reviewer can reproduce the claim without guessing and without using hidden data.
- Negative control
- Secrets, unrelated user data, and raw listener credentials are absent.
- Stop condition
- Submit only the demonstrated claim.
Related methods
Continue with the right depth.
Sources