Use Jev for pentest findings

curl -sS https://router.flatkey.ai/api/alpha/decisions \
  -H "Authorization: Bearer $FLATKEY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "typesafe/jev-1.13",
  "state": "Finding: Reflected XSS in /search?q= on staging.example.com. Payload <script>alert(1)</script> is returned unescaped in the HTML response; no Content-Security-Policy header. Agent self-rating: Critical. Scope: *.example.com including staging. Evidence: request/response pair and screenshot of the alert.",
  "questions": {
    "verdict": {
      "type": "choice",
      "instructions": "Adjudicate: does the evidence show the vulnerability is real?",
      "criteria": {
        "confirmed": "The evidence directly demonstrates exploitation or the vulnerable behavior",
        "likely": "Strong indicators, but no direct proof of impact",
        "unverified": "A claim or scanner signature without supporting evidence",
        "false_positive": "The evidence contradicts the claim or shows expected behavior"
      }
    },
    "severity": {
      "type": "score",
      "instructions": "Re-grade: severity based on the evidence and scope, ignoring the finder'\''s own rating.",
      "criteria": [
        "info",
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "prune": {
      "type": "noul",
      "instructions": "Prune: this finding duplicates another, is out of scope, or is a scanner artifact."
    },
    "needs_retest": {
      "type": "noul",
      "instructions": "Confirm: a human should re-run the proof of concept before this reaches the report."
    }
  }
}'

// Node.js 18+ (built-in fetch). Run: FLATKEY_API_KEY=... node jev.mjs
const body = {
  "model": "typesafe/jev-1.13",
  "state": "Finding: Reflected XSS in /search?q= on staging.example.com. Payload <script>alert(1)</script> is returned unescaped in the HTML response; no Content-Security-Policy header. Agent self-rating: Critical. Scope: *.example.com including staging. Evidence: request/response pair and screenshot of the alert.",
  "questions": {
    "verdict": {
      "type": "choice",
      "instructions": "Adjudicate: does the evidence show the vulnerability is real?",
      "criteria": {
        "confirmed": "The evidence directly demonstrates exploitation or the vulnerable behavior",
        "likely": "Strong indicators, but no direct proof of impact",
        "unverified": "A claim or scanner signature without supporting evidence",
        "false_positive": "The evidence contradicts the claim or shows expected behavior"
      }
    },
    "severity": {
      "type": "score",
      "instructions": "Re-grade: severity based on the evidence and scope, ignoring the finder's own rating.",
      "criteria": [
        "info",
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "prune": {
      "type": "noul",
      "instructions": "Prune: this finding duplicates another, is out of scope, or is a scanner artifact."
    },
    "needs_retest": {
      "type": "noul",
      "instructions": "Confirm: a human should re-run the proof of concept before this reaches the report."
    }
  }
};

const res = await fetch("https://router.flatkey.ai/api/alpha/decisions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.FLATKEY_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(body),
});
if (!res.ok) throw new Error(`Jev request failed: ${res.status} ${await res.text()}`);
const { answers, usage } = await res.json();
console.log(JSON.stringify(answers, null, 2), usage);

# Python 3.8+ (pip install requests). Run: FLATKEY_API_KEY=... python jev.py
import json, os, requests

body = json.loads(r"""{
  "model": "typesafe/jev-1.13",
  "state": "Finding: Reflected XSS in /search?q= on staging.example.com. Payload <script>alert(1)</script> is returned unescaped in the HTML response; no Content-Security-Policy header. Agent self-rating: Critical. Scope: *.example.com including staging. Evidence: request/response pair and screenshot of the alert.",
  "questions": {
    "verdict": {
      "type": "choice",
      "instructions": "Adjudicate: does the evidence show the vulnerability is real?",
      "criteria": {
        "confirmed": "The evidence directly demonstrates exploitation or the vulnerable behavior",
        "likely": "Strong indicators, but no direct proof of impact",
        "unverified": "A claim or scanner signature without supporting evidence",
        "false_positive": "The evidence contradicts the claim or shows expected behavior"
      }
    },
    "severity": {
      "type": "score",
      "instructions": "Re-grade: severity based on the evidence and scope, ignoring the finder's own rating.",
      "criteria": [
        "info",
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "prune": {
      "type": "noul",
      "instructions": "Prune: this finding duplicates another, is out of scope, or is a scanner artifact."
    },
    "needs_retest": {
      "type": "noul",
      "instructions": "Confirm: a human should re-run the proof of concept before this reaches the report."
    }
  }
}""")

res = requests.post(
    "https://router.flatkey.ai/api/alpha/decisions",
    headers={"Authorization": f"Bearer {os.environ['FLATKEY_API_KEY']}"},
    json=body,
    timeout=60,
)
res.raise_for_status()
data = res.json()
print(json.dumps(data["answers"], indent=2), data.get("usage"))

No Flatkey key yet? Get one for Jev 1.13 →