AI Agent Framework
Relevant source files
The following files were used as context for generating this wiki page:
The AI Agent Framework is a sophisticated decision and verification system designed to provide high-confidence security analysis through multi-model orchestration. Its primary purpose is to ingest raw security findings from various scanners, enrich them with business and threat context, and utilize specialized AI agents to reach a consensus on remediation and risk prioritization.
The framework operates as an "Intelligence Layer" within the FixOps ecosystem, bridging the gap between automated scanning and executive decision-making. By consulting multiple Large Language Models (LLMs) and specialized cyber models in parallel, it identifies complex attack paths, estimates financial impact, and generates validated remediation code.
System Architecture and Components
The framework is structured as a multi-stage pipeline that transitions from data normalization to automated reasoning and consensus.
Core Component Breakdown
| Component | Description | Technologies |
|---|---|---|
| AIAgentAdvisor | Detects AI-specific frameworks within design artifacts and recommends controls. | Python, regex signatures |
| Multi-AI Orchestrator | Orchestrates parallel analysis across different LLM providers for consensus. | GPT-4, Claude, Gemini |
| Advanced Pentest Engine | Simulates complex attack chains and privilege escalation paths. | Python, Threat Intel APIs |
| Business Impact Quantifier | Translates technical vulnerabilities into financial risk estimates (USD). | Risk modeling, Benchmarks |
| Remediation Generator | Produces validated code fixes tailored to specific languages and frameworks. | AI-powered code gen |
Sources: core/ai_agents.py:44-50, fixops-enterprise/src/services/advanced_pentest_engine.py:734-745, frontend/src/pages/ArchitectureCenter.jsx:65-100
Multi-Model Orchestration Flow
The system utilizes a consensus-based approach to minimize false positives and resolve model disagreements.
The diagram shows the parallel execution of multiple AI agents and the subsequent consensus gathering phase.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:613-645, frontend/src/pages/EnhancedDashboard.jsx:175-186
Security Intelligence and Reasoning
The framework performs deep analysis by mapping findings to external intelligence sources and internal business contexts.
AI Agent Advisor
The AIAgentAdvisor class is responsible for identifying AI frameworks (e.g., LangChain, AutoGPT) within the project's own design files. It uses FrameworkSignature objects to match keywords and package indicators, subsequently flagging potential threat profiles and recommended controls.
Sources: core/ai_agents.py:53-70, core/ai_agents.py:157-190
Advanced Attack Simulation
The AdvancedAttackSimulator models how an attacker might chain individual vulnerabilities to achieve a high-impact breach. It specifically analyzes:
- Chained Exploits: Combining low-severity issues (e.g., an injection and an auth bypass) to create a high-severity critical path.
- Privilege Escalation: Mapping paths from anonymous or guest access to administrative/root privileges.
- Lateral Movement: Simulating techniques like RDP, SSH, or Pass-the-Hash to move between internal systems.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:814-830, fixops-enterprise/src/services/advanced_pentest_engine.py:863-885
Business Impact Quantification
A critical feature of the framework is its ability to translate technical risk into executive-level business metrics.
The relationship between technical findings and their business impact metrics used for executive reporting.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:195-225, fixops-enterprise/src/services/advanced_pentest_engine.py:1120-1150
Impact Calculation Logic
The BusinessImpactQuantifier uses several weighted factors to estimate financial loss:
- Cost Per Record: Varies by data classification (e.g., $180/record for Confidential, $500/record for Top Secret).
- Downtime Cost: Calculated based on asset criticality and hourly revenue at risk.
- Regulatory Fines: Estimates potential exposure under GDPR (up to 4% revenue), HIPAA, or CCPA.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:943-965, fixops-enterprise/src/services/advanced_pentest_engine.py:1017-1035
Consensus and Disagreement Analysis
When multiple models analyze a finding, the MultiAIOrchestrator applies different consensus strategies to determine the final output.
Consensus Strategies
| Strategy | Logic |
|---|---|
| Weighted | Aggregate results based on the confidence scores of individual models. |
| Majority | Select the decision supported by more than 50% of active models. |
| Highest Confidence | Trust only the single model that reports the highest internal confidence score. |
| Unanimous | Require 100% agreement; otherwise, trigger an expert manual review. |
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:653-700, frontend/src/pages/EnhancedDashboard.jsx:455-480
Remediation Code Generation
The framework doesn't just identify risks; it generates fixes.
# Sources: [fixops-enterprise/src/services/advanced_pentest_engine.py:448-456](https://github.com/DevOpsMadDog/Fixops/blob/HEAD/fixops-enterprise/src/services/advanced_pentest_engine.py#L448-L456)
async def generate_remediation(
self, finding: Dict[str, Any], language: str, framework: Optional[str]
) -> RemediationCode:
"""Generate remediation code for a vulnerability."""
# The engine selects appropriate templates or prompts based on
# the categorized vulnerability (e.g., SQLi, XSS) and target stack.
API and Integration Surface
The AI Agent Framework is exposed via several high-level REST endpoints and CLI commands for CI/CD integration.
Key API Endpoints
POST /api/v1/enhanced/compare-llms: Ingests findings and returns a side-by-side comparison of different AI model analyses.POST /api/v1/enhanced/analysis: Executes the full consensus pipeline and returns the final ALLOW/BLOCK decision.GET /api/v1/enhanced/capabilities: Returns current system metrics including hot-path latency and active model providers.
Sources: frontend/src/pages/EnhancedDashboard.jsx:250-265, CLI_API_INVENTORY.md:120-135
Summary
The AI Agent Framework represents a transition from simple vulnerability scanning to intelligent security operations. By combining multi-AI consensus, advanced attack simulation, and financial impact quantification, it provides a comprehensive intelligence layer that serves both technical developers and executive stakeholders. Its ability to generate validated remediation code and persist evidence in an immutable "Evidence Lake" ensures that security decisions are both actionable and auditable.