Clever Monkey

vuln-verdict helps security teams deal with the flood of alerts from static analysis tools. Semgrep can flag dozens of possible bugs in a Java project, and someone has to read every one to find the real ones. vuln-verdict reads a standard SARIF file and sorts each alert into one of three lanes: confident true positive, needs review, or likely false positive. A human still confirms the last lane. It never hides or suppresses an alert, so everything stays in the report and the output SARIF. For the confident true positives, it also explains the attack path and proposes a fix, then re-runs Semgrep to check the alert is gone. Those fixes are marked Semgrep-cleared, not compiled or tested. The repo has an offline demo and a script to run the real model on Modal.