Project Overview
Relevant source files
The following files were used as context for generating this wiki page:
Fixops is an enterprise-grade Decision and Verification Engine designed to streamline DevSecOps operations. It functions as a centralized intelligence layer that ingests security findings from various scanners (SAST, DAST, SCA, Cloud), enriches them with business context, and applies multi-model AI consensus to deliver high-confidence remediation decisions.
The system is architected to eliminate false positives and accelerate deployment gating by providing immutable evidence trails and automated policy evaluation. It supports both a lightweight "demo" mode for quick validation and a comprehensive "enterprise" mode for production-scale deployments with deep integrations into CI/CD pipelines and external security tooling.
Sources: frontend/src/pages/EnhancedDashboard.jsx:166-180, tests/e2e/README.md:1-10, CLI_API_INVENTORY.md:1-10
Core Architecture and Components
The Fixops architecture is divided into specialized layers that handle data ingestion, processing, and decision-making.
Processing Pipeline
The system follows a structured 12-step operational flow to transform raw security data into actionable business decisions:
Key System Components
The architecture utilizes several core components to ensure low-latency, high-accuracy processing:
| Component | Technology/Library | Purpose |
|---|---|---|
| Vector Database | ChromaDB / In-Memory | Stores security patterns and finding embeddings for similarity search. |
| LLM Engine | Emergent LLM (GPT-4, Claude, Gemini) | Orchestrates parallel analysis across multiple specialized AI models. |
| Policy Engine | OPA (Open Policy Agent) | Evaluates findings against Rego-based governance policies. |
| Processing Layer | pgmpy, mchmm, NetworkX | Handles Bayesian prior mapping and Markov state transitions. |
| Evidence Lake | SQL/Storage Overlay | Persists an immutable trail of findings, AI reasoning, and decisions. |
| Sources: frontend/src/pages/ArchitectDashboard.jsx:92-175, frontend/src/pages/EnhancedDashboard.jsx:75-90 |
Multi-AI Orchestration and Consensus
A primary feature of Fixops is its ability to consult multiple Large Language Models (LLMs) to reach a consensus on security risks. This approach reduces model-specific bias and increases decision reliability.
Consensus Strategies
The MultiAIOrchestrator manages different strategies for aggregating model outputs:
- Weighted: Weights model outputs based on individual confidence scores.
- Majority: Reaches a decision based on the most common recommendation.
- Highest Confidence: Adopts the result from the model with the highest reported certainty.
- Unanimous: Requires all models to agree; otherwise, triggers an expert review.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:461-550
Consensus Flow
The following sequence illustrates how the system processes a finding through the Multi-AI layer:
Advanced Penetration Testing Engine
Fixops includes a sophisticated penetration testing module designed to simulate complex attack paths and quantify financial risks.
Attack Simulation
The engine performs advanced modeling to identify how vulnerabilities can be combined to compromise a system:
- Chained Exploits: Generates sequences where one vulnerability (e.g., SQL Injection) is used to enable another (e.g., Auth Bypass).
- Privilege Escalation: Maps paths from anonymous/guest access to administrative or root privileges.
- Lateral Movement: Simulates how an attacker might move between adjacent systems using compromised credentials or network flaws.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:567-670
Business Impact Quantification
The system estimates the financial impact of a breach by evaluating:
- Asset Criticality: Ranges from Mission Critical to Development.
- Data Classification: Public, Internal, Confidential, Restricted, or Top Secret.
- Regulatory Fines: Potential penalties under GDPR, HIPAA, PCI-DSS, or SOX.
- Operational Costs: Including downtime costs per hour and incident response efforts.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:165-210, fixops-enterprise/src/services/advanced_pentest_engine.py:720-760
Data Ingestion and CLI
Fixops supports a wide range of input formats for security findings and environmental data.
Supported Input Formats
| Category | Formats | CLI / API Interaction |
|---|---|---|
| SBOM | CycloneDX, SPDX, Syft, GitHub Snapshot | POST /inputs/sbom |
| SAST/DAST | SARIF | POST /inputs/sarif |
| Vulnerability | CVE Feed, KEV, VEX Documents | POST /inputs/cve, POST /inputs/vex |
| Cloud/Runtime | CNAPP, Falco, Security Hub | POST /inputs/cnapp |
| Design | FixOps Design Input JSON | POST /inputs/design |
| Sources: CLI_API_INVENTORY.md:120-160, frontend/src/pages/EnhancedDashboard.jsx:215-240 |
Command Line Interface (CLI)
The core/cli.py module provides several operational commands:
- stage-run: Normalizes a single stage input and produces canonical outputs.
- run: Executes the full pipeline locally to generate an evidence bundle and decision.
- train-forecast: Calibrates the probabilistic severity forecast engine using historical incident records.
- pentagi: Manages AI-powered penetration testing requests and configurations.
Sources: CLI_API_INVENTORY.md:1-80
Technical Metadata and Analysis
The project includes automated analysis tools to maintain traceability and summarize file roles.
| Role | Target Directories | Primary Responsibility |
|---|---|---|
| API | apps/api/ | Inbound interfaces and request routing. |
| Core Logic | core/ | Pipeline orchestration and engine logic. |
| Enterprise | enterprise/ | Production-grade overlays and advanced services. |
| Tests | tests/, tests/e2e/ | Validation suites and deployment health checks. |
| Sources: scripts/generate_analysis.py:70-85 |
Conclusion
Fixops serves as a critical bridge between raw security scanning and high-level business risk management. By combining traditional normalization with advanced AI consensus and financial impact modeling, it provides security architects and developers with a clear, evidence-backed path to secure software delivery. Its modular design allows for flexible deployment, ranging from simple CI/CD gates to complex enterprise security command centers.
Sources: frontend/src/pages/EnhancedDashboard.jsx:380-450, tests/e2e/README.md:1-15