Documentation
¶
Overview ¶
Package scanpolicy holds the scoring choices a scan makes, so every entry point into Draugr makes the same ones. The CLI and the MCP server both run scans; if they prioritized differently, the answer an agent gave and the answer CI gave would diverge for no reason a user could see.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPrioritizer ¶
func DefaultPrioritizer(expl *exploit.Source) engine.Prioritizer
DefaultPrioritizer scores a finding from its severity and the component's declared exposure and criticality, optionally escalating on exploitability. expl may be nil, in which case enrichment is skipped.
func GateThresholds ¶ added in v0.98.0
func GateThresholds(g *saga.GateConfig) map[string]sarif.Severity
GateThresholds converts a descriptor's gate block into the per-control map a Policy takes. Nil when unset, which leaves every control on the default threshold.
Here rather than beside either caller for the reason in the package doc. A verdict is the answer Draugr exists to give, and one entry point applying the descriptor's gate while another applied a fixed default would have an agent and CI disagree about the same descriptor — with nothing in either answer to show which policy produced it.
Validation has already rejected anything that is neither a band nor one of the SARIF levels still accepted, so an unparseable value cannot reach here; it is dropped rather than becoming a threshold nobody chose.
Types ¶
This section is empty.
Source Files