> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Remediate vulnerabilities with AI

Implement with AI

Send this guide to your coding agent.

Prerequisite: Install Port MCP

Open in ClaudeOpen in CodexOpen in Cursor
Open plan mode if your tool supports it; otherwise present the plan below filled in and wait for my approval. Implement this Port guide in my org via MCP:

https://docs.port.io/guides/all/remediate-vulnerability-with-ai

Read the raw markdown version at https://docs.port.io/guides/all/remediate-vulnerability-with-ai.md - it contains every tab and code block without page markup.

Goal: get the guide's core flow working end-to-end in my org; adapting it to fit my existing setup takes priority over matching the guide 1:1.

Plan:
1. Confirm MCP is connected, in the right org, with sufficient permissions.
2. If the guide offers alternative implementation paths (tabs), pick the one matching my installed integrations and tools, confirm it with me, and implement only that path.
3. Diff the guide's data model (blueprints, properties, relations, workflows, actions, agents, automations, integrations, webhook data sources, secrets) against mine.
4. Propose adaptations for gaps, reusing existing blueprints/relations over guide-named duplicates.
5. Flag what needs a UI click, credential, or secret from me, testing MCP capability empirically before ruling anything out. If the guide has a "Set up via API" section, use it for anything MCP can't do before treating a step as UI-only.
6. Stop on any blocker and give me options. Approving this plan authorizes the writes it lists; pause only for writes beyond what's listed.

Build:
- Extend blueprint schema additively when upserting; don't remove or overwrite existing properties, and treat type conflicts as a blocker, not an auto-fix.
- Never print secret values into the chat or logs; ask me to set them in Port, or write them via the secrets API without echoing them back.
- List any mock data in the plan, minimal and labeled mock; once approved, seed it without re-asking, and tell me what you seeded.
- For anything the guide writes downstream (e.g. a webhook target), use a real entity, not a mock.
- For pages/widgets, use the real page identifier from the app URL, not a guessed slug.
- When you hit a UI step confirmed (not assumed) unsupported via MCP and not covered by the guide's API sections, pause, give exact clicks, then resume via MCP.
- Validate and give links after each meaningful step (only a tool-returned URL, no guessed paths); don't proceed if the last run wasn't a success.

Done:
- Run the guide's "Let's test it" steps where possible (e.g. execute a workflow test run) and confirm the expected output exists in Port.
- Summarize adaptations, seeded data, what was mocked or skipped, remaining UI steps, and how to verify.

A security vulnerability is a work item like any other ticket. It needs context, a routing decision, and often a coding agent to implement the fix. This guide applies Port's autonomous ticket resolution (ATR) pattern to vulnerabilities using a single Port workflow, so teams can move from a raw scanner finding to a merged fix without manual triage.

Security teams often face two critical challenges that slow down vulnerability remediation:

  1. Understanding vulnerabilities quickly - Raw scanner output is dense, technical, and rarely provides clear remediation steps.
  2. Acting fast enough - Even after analysis, fixing issues typically requires manual developer effort, leading to delays and higher risk exposure.

This guide demonstrates how to solve both problems with one event-triggered workflow. When a vulnerability is marked as critical, the workflow invokes an AI agent to enrich it with a clear summary and remediation steps, saves the analysis to the catalog, and dispatches your coding agent backend to generate a fix in a pull request.

Vulnerability triggering AI analyzer and Claude Code PR

Common use cases​

  • Automatically enrich critical vulnerabilities with plain-language impact and remediation guidance.
  • Trigger a coding agent to open a pull request with a proposed fix minutes after severity escalation.
  • Reduce time-to-remediation without manual handoffs between security and engineering teams.

Prerequisites​

Before you begin, ensure you have:

Set up data model​

First, you need to ensure your vulnerability blueprint includes an ai_summary property to store the AI-generated analysis.

  1. Go to the builder page of your portal.

  2. Search for the blueprint you want to update.

  3. Click on the {...} button in the top right corner, and choose Edit JSON.

  4. Add this JSON snippet to the properties of the blueprint:

    "ai_summary": {
      "type": "string",
      "title": "AI Analysis",
      "description": "AI-generated analysis and remediation steps",
      "format": "markdown"
    }

  5. Click Save.

Blueprint identifier

This guide uses securityVulnerability as the blueprint identifier in the workflow JSON. Change it to match your data model (e.g., snykVulnerability, wizIssue, or sonarQubeIssue).

Configure the service relation​

The workflow sends coding agent work to the GitHub repository that owns the vulnerable code. Every backend tab reads relations.service from the triggered vulnerability entity. For these steps to succeed, the service relation on your vulnerability blueprint must resolve to a GitHub repository identifier in org/repo format (for example port-labs/port-docs).

If vulnerabilities are not linked to a service yet:

  • In the builder, add a service relation on your vulnerability blueprint pointing to your service blueprint.
  • Update your security integration mapping to set the relation during sync (often from project name, repository URL, or a project-to-service match).

Create your AI agent​

Create an AI agent that analyzes vulnerabilities. The workflow invokes this agent directly, it does not need access to self-service actions.

  1. Go to the AI Agents page of your portal.

  2. Click on + AI Agent.

  3. Toggle Json mode on.

  4. Copy and paste the following JSON schema:

    Vulnerability enrichment agent (Click to expand)
    {
      "identifier": "vulnerability_enrichment_agent",
      "title": "Vulnerability Enrichment Agent",
      "icon": "Vulnerability",
      "properties": {
        "description": "Provides remediation steps and mitigation strategies for vulnerabilities",
        "status": "active",
        "prompt": "You are an agent responsible for analyzing security vulnerabilities and providing actionable recommendations.\n\n### Guidelines\n- Summarize the vulnerability in simple terms.\n- Explain the potential impact if exploited.\n- Recommend step-by-step remediation strategies.\n- Suggest best practices to prevent similar vulnerabilities.\n- Tailor responses to the severity (Critical, High, Medium, Low).\n\nReturn your analysis as clear Markdown suitable for storage in a catalog property and for use by a coding agent that will implement the fix.",
        "execution_mode": "Automatic",
        "conversation_starters": [
          "Explain the impact of CVE-2025-1234",
          "Suggest a remediation plan for this SQL injection vulnerability",
          "What steps should I take to patch a high severity XSS issue?"
        ],
        "tools": [
          "^(list|search|track|describe)_.*"
        ]
      },
      "relations": {}
    }
    MCP enhanced capabilities

    The ^(list|search|track|describe)_.* pattern lets the agent read related entities from your context lake for richer vulnerability context.

  5. Click Create to save the agent.

Build the workflow​

When a vulnerability becomes critical, this workflow enriches it, saves the AI summary, and dispatches your coding agent to propose a fix.

Trigger customization

This workflow triggers when severity changes to critical. You can adapt the event trigger condition to match your policy, for example High or above, specific services, or newly created vulnerabilities.

Choose the workflow JSON that matches your coding agent:

Build the workflow

  1. Go to the Workflows page of your portal.

  2. Click on the + Workflow button in the top-right corner.

  3. In the Name field, enter Remediate critical vulnerability, then click Confirm.

  4. On the editor page, click the see workflow JSON button (the code icon) to open the JSON editor.

  5. Copy and paste the workflow JSON below to replace the example workflow:

    Remediate critical vulnerability workflow JSON for Claude Code (click to expand)
    {
      "identifier": "remediate_critical_vulnerability",
      "title": "Remediate critical vulnerability",
      "icon": "Vulnerability",
      "description": "Enrich critical vulnerabilities with AI analysis and dispatch Claude Code to propose a fix",
      "allowAnyoneToViewRuns": true,
      "nodes": [
        {
          "identifier": "trigger",
          "title": "On severity changed to critical",
          "icon": "Vulnerability",
          "description": "Trigger when a vulnerability severity changes to critical",
          "config": {
            "type": "EVENT_TRIGGER",
            "event": {
              "type": "ENTITY_UPDATED",
              "blueprintIdentifier": "securityVulnerability"
            },
            "condition": {
              "type": "JQ",
              "expressions": [
                ".diff.before.properties.severity != \"critical\"",
                ".diff.after.properties.severity == \"critical\""
              ],
              "combinator": "and"
            }
          },
          "variables": {}
        },
        {
          "identifier": "enrich_vulnerability",
          "title": "Analyze vulnerability with AI",
          "icon": "AI",
          "description": "Invoke the Vulnerability Enrichment Agent",
          "config": {
            "type": "AI_AGENT",
            "agentIdentifier": "vulnerability_enrichment_agent",
            "userPrompt": "Generate a summary and remediation steps for vulnerability with entity identifier {{ .outputs.trigger.diff.after.identifier }}. The issue has been updated with the following details: {{ .outputs.trigger.diff.after.properties | tojson }}"
          },
          "variables": {}
        },
        {
          "identifier": "save_ai_summary",
          "title": "Save AI summary",
          "icon": "Vulnerability",
          "description": "Update the vulnerability entity with the AI-generated analysis",
          "config": {
            "type": "UPSERT_ENTITY",
            "blueprintIdentifier": "securityVulnerability",
            "mapping": {
              "identifier": "{{ .outputs.trigger.diff.after.identifier }}",
              "properties": {
                "ai_summary": "{{ .outputs.enrich_vulnerability.response }}"
              }
            }
          },
          "variables": {}
        },
        {
          "identifier": "run_claude_code",
          "title": "Generate fix with Claude Code",
          "icon": "Code",
          "description": "Dispatch Claude Code to generate a fix and open a pull request",
          "config": {
            "type": "INTEGRATION_ACTION",
            "installationId": "<YOUR_GITHUB_OCEAN_INTEGRATION_ID>",
            "integrationProvider": "github-ocean",
            "integrationInvocationType": "dispatch_workflow",
            "integrationActionExecutionProperties": {
              "org": "<YOUR_GITHUB_ORG>",
              "repo": "<YOUR_WORKFLOW_REPO>",
              "workflow": "claude-backend.yaml",
              "workflowInputs": {
                "repo_name": "{{ .outputs.trigger.diff.after.relations.service }}",
                "command": "Here is the information about the security vulnerability: {{ .outputs.trigger.diff.after | tojson }}.\n\nGenerate a code fix for the issue based on the AI-provided summary:\n\n{{ .outputs.enrich_vulnerability.response }}\n\nAfter generating the code, open a PR with a description summarizing what was fixed and why."
              },
              "reportWorkflowStatus": true
            }
          },
          "variables": {}
        }
      ],
      "connections": [
        {
          "sourceIdentifier": "trigger",
          "targetIdentifier": "enrich_vulnerability"
        },
        {
          "sourceIdentifier": "enrich_vulnerability",
          "targetIdentifier": "save_ai_summary"
        },
        {
          "sourceIdentifier": "save_ai_summary",
          "targetIdentifier": "run_claude_code"
        }
      ]
    }

  6. Click Save to save the workflow.

Replace placeholders

Replace YOUR_GITHUB_OCEAN_INTEGRATION_ID, YOUR_GITHUB_ORG, and YOUR_WORKFLOW_REPO with your GitHub Ocean integration ID, organization name, and the repository where claude-backend.yaml lives.

Test your workflow​

Now it's time to test the complete vulnerability enrichment flow:

  1. Create or sync a vulnerability with severity set to Critical, or update an existing vulnerability's severity to critical.

  2. Port runs the workflow automatically when the severity change is detected.

  3. Verify the workflow run on the Workflow page. Confirm the trigger, AI analysis, save summary, and coding agent dispatch nodes completed successfully.

  4. Check the vulnerability entity in the catalog and confirm ai_summary was populated.

  5. Review the pull request or Copilot issue opened by your coding agent backend.

  6. Merge the PR to complete the remediation loop.

Claude Code pull request fixing CVE Alpine base image

What's next?​

Your automated security workflow is now complete. Here are some ways you can extend it:

  • Customize triggers: Adjust the event trigger condition based on your security policies.
  • Add approval steps: Insert a condition or manual gate before dispatching the coding agent.
  • Scale to other issue types: Apply the same pattern to bugs, performance issues, or compliance violations.