# External prior-art + try-later — scanned 2026-06-19

audience: AI coding agents first. BLUF. Living note. Landscape scan of external agent/LLM security tools vs security-gate. Records what is OUT of scope, what is PRIOR ART, and what is a TRY-LATER candidate (with the gate it must pass before adoption). Points to SoT; never re-inlines it.

## Verdict table

| Tool | What it scans | Overlap with us | Verdict |
|---|---|---|---|
| [scadastrangelove/agent-audit](https://github.com/scadastrangelove/agent-audit) | the AGENT SURFACE (session logs, agent-home configs, CLAUDE.md/AGENTS.md, skills, plugins, MCP manifests) | NONE — different layer | OUT OF SCOPE. Different threat model (OWASP Agentic/MCP Top-10 + MITRE ATLAS), not app-code defects. Adjacent complement IF we ever open an `agent-surface` domain. License NOASSERTION (vendoring hazard). |
| [cyberok-org/nuclei-autotriage](https://github.com/cyberok-org/nuclei-autotriage) | DAST output (Nuclei HTTP req/resp JSONL) | the TRIAGE LAYER, not the scanner | TRY-LATER (pattern only). License NOASSERTION. |
| [protectai/vulnhuntr](https://github.com/protectai/vulnhuntr) | SOURCE CODE (Python only, Jedi) — source→sink call chains | CLOSEST tool — band-2 cross-file territory | TRY-LATER (pattern only). AGPL-3.0 — read for ideas, NEVER copy code. |
| [SunWeb3Sec/llm-sast-scanner](https://github.com/SunWeb3Sec/llm-sast-scanner) | SOURCE CODE (Java/Python/JS-TS/PHP/.NET) — source→sink taint, a Claude Code SKILL | DIRECT PEER of our LLM bands (same family) | PRIOR ART, validates our design. NOT adoptable wholesale (LLM-band-only, unmeasured, no oracle/no-false-clean). **MIT (README-stated, no LICENSE file) → reusable WITH ATTRIBUTION.** Reusable: the 34-class taxonomy + reference KBs as breadth cross-check / prompt input. |

## TRY-LATER #1 — two-stage falsifier + calibrated red-team confidence (from nuclei-autotriage)
**The pattern, reimplemented for source code (NOT the DAST prompts).** Two distinct passes:
1. **Falsifier-first verdict** — model hunts for concrete FALSE-POSITIVE signals; finding stays positive only if none fire. Source-code falsifiers (replace their DAST ones): decisive predicate in an UNRESOLVED import → downgrade (defect #2); defect lives SOLELY in comment/illustration trivia → already the shipped prompt fix; executable-stub / placeholder context (the residual ~50% from the A/B) → new falsifier.
2. **Calibrated confidence** — a SEPARATE red-team pass that attacks the stage-1 verdict and emits confidence ∈ [0,1]. Replaces roll-count as the truth proxy → retires defect #3 (roll-count ≠ true-positive probability).

**Adoption gate (no-false-clean — LOAD-BEARING):** the falsifier is a CONFIDENCE/RANKING signal, NEVER a suppressor. A wrong falsifier must not bury a real bug — same stance as the citation spec's "Anchor is NOT a filter" note. Build target = the deferred band-2 verification stage. SoT for the defects: `docs/validation/2026-06-19-live-fire-precision-3repos.md` §"The 3 gate-improvement findings".

## TRY-LATER #2 — on-demand symbol resolution loop (from vulnhuntr)
**The pattern (AGPL — reimplement from idea, do NOT copy code/prompts).** vulnhuntr builds source→sink call chains by an AGENTIC loop: the LLM REQUESTS a symbol definition, a static-analysis backend (Jedi) RESOLVES it across files, context expands iteratively until the chain is complete. Found real 0-days (CVE-2024-10044 SSRF, -10131 RCE, IDOR/LFI/XSS across 14k–67k-star repos).

**Contrast with our shipped resolver #36:** ours is EAGER (pull ALL first-party called imports up to budget, then review). vulnhuntr is LAZY/ON-DEMAND (pull only what the model asks for, as it reasons). On-demand may scope tighter + deeper per finding — candidate input to the **deferred Opus production orchestrator** (band-2), not the eager resolver.

**Why NOT a drop-in:** (a) Python-only via Jedi — our live targets are TS/JS (zync/trance/platform); (b) injection/RCE-focused (LFI/AFO/RCE/XSS/SQLI/SSRF/IDOR) — NO money-depth (S9 finance: idempotency, fail-open HMAC, payment atomicity — our confirmed live-fire catches); (c) AGPL-3.0 viral copyleft.

## PRIOR ART — llm-sast-scanner is our closest LLM-band PEER (independent design validation)
A Claude Code SKILL doing the SAME thing as our LLM bands: 6-step source→sink taint workflow (load refs → map sources → trace taint → **Judge**-verify → report file:line + remediation) over 34 vuln-class markdown reference KBs, multi-language (incl. TS).
**It independently rediscovers our measured discipline** — its "Advanced tips" say: *precompute call graph* (= our resolver #36), *run 2+ scanning rounds* (= our k≥3), *enforce per-finding validation* (= the deferred verification stage / defect #3). Convergence from a separate author = strong signal our architecture is right.
**Why NOT adoptable (it is BEHIND us, not ahead):** LLM-band-only — NO deterministic oracle band, NO measured recall/corpus, NO no-false-clean contract, NO statistical k≥3 (its "Judge" is a single prompt step, not adversarially calibrated). It is our band-1 + a hand-wave of band-2, minus the validation discipline that is our whole product ("coverage is the product").
**Reusable (MIT, attribution required):** the 34-class reference taxonomy + reference KBs. (1) BREADTH cross-check against `docs/taxonomy/security.md` blind-spot map — does any of its 34 (business_logic, race_conditions, trust_boundary, smuggling_desync, jndi_injection, expression_language_injection, http_method_tamper) name a class our S1–S11 map omits → if yes, flag BLIND SPOT, never "covered". (2) Its per-class KB content may inform our per-detector prompts. Money-depth (S9 idempotency/HMAC/payment-atomicity) is OUR edge — its closest is `business_logic.md` + `race_conditions.md`, shallower. MIT = copy-OK WITH attribution; cite SunWeb3Sec/llm-sast-scanner.

## Common rule across all four
**License posture — verify before ANY reuse.** agent-audit + nuclei-autotriage = NOASSERTION (non-standard, treat read-only); vulnhuntr = AGPL-3.0 (viral copyleft — read for ideas, NEVER copy code); llm-sast-scanner = **MIT** (README-stated, no LICENSE file — reuse OK WITH attribution; the no-file provenance is a minor weakness, the grant is explicit). Default for the copyleft/unclear three: reimplement the idea, cite the source. Only llm-sast-scanner permits direct KB/prompt reuse, attributed.