0 Fork 0

mirror of https://github.com/Ed1s0nZ/CyberStrikeAI.git synced 2026-11-13 15:57:22 +01:00

Files

T

Sycun cfaa95d7bd refactor(runtime): remove Eino and make Pi the sole agent engine

Delete the Eino model adapters, callbacks, middleware, orchestration,
summarization and single-agent runner together with their dependencies.
Chat, batch tasks, workflow Agent nodes and sub-agents now share the Pi
runtime, and dispatch is a single code path instead of an engine switch.

Configuration migrates eino_middleware/eino_skills to runtime/skills and
drops the retired callback settings while old files still load. Settings,
i18n and docs describe Pi only. Also carry the Pi follow-up fixes: empty
required lists are omitted from tool schemas, historical tool results stay
with their call batch, model proxies work over HTTP/1.1, single-query
retrieval skips query expansion, and finalization docs match Pi lifecycle
events.

2026-11-12 17:55:36 +08:00

2.6 KiB

Raw Blame History

Knowledge Base

中文

The knowledge base turns local security notes, playbooks, vulnerability guides, and organizational standards into retrievable context for Agents.

Enable

knowledge:
  enabled: true
  base_path: knowledge_base
  embedding:
    provider: openai
    model: text-embedding-v4
database:
  knowledge_db_path: data/knowledge.db

Keep the knowledge DB separate when you want portable reusable indexes.

Internal Pipeline

flowchart LR
    F["Markdown / Web item"] --> M["Manager"]
    M --> C["Chunker"]
    C --> E["Embedding"]
    E --> V["SQLite Vector Index"]
    Q["Agent query"] --> MQ["MultiQuery"]
    MQ --> V
    V --> R["Rerank"]
    R --> P["Post-process"]
    P --> A["Agent context"]

Quality depends on source structure, chunk size, embedding quality, and rerank behavior.

Content Writing

Bad:

SQL injection is dangerous. Use sqlmap. Filter input.

Better:

# MySQL UNION Injection Verification

## Preconditions
- Parameter is concatenated into SELECT.

## Steps
1. Use `order by` to infer column count.
2. Use `union select null,...` to find reflection.
3. Use read-only functions to confirm DB type.

## False Positives
- WAF error page.
- Generic error page.

## Fix
- Parameterized queries.
- Least DB privilege.

Structured headings and concrete steps improve chunking and retrieval.

Tuning

Use a fixed test query set, then change one variable at a time:

empty results: lower similarity_threshold, verify indexing;
wrong topic: improve titles and category/risk type;
broken context: tune chunk_size and chunk_overlap;
noisy results: raise threshold or fix rerank;
high cost: lower multi_query.max_queries, prefetch_top_k, or top_k.

MCP Tools

Enabled KB registers tools such as:

list risk types;
search knowledge base.

Prompt roles to query the KB before giving vulnerability validation or remediation advice when unsure.

Retrieval Logs

Use logs to improve content:

frequent no-results queries: missing content or synonyms;
low scores: titles/terms mismatch;
duplicate hits: merge or categorize docs;
Agent ignores results: output may be too long or not actionable.

Source Anchors

Manager: internal/knowledge/manager.go
Index pipeline: internal/knowledge/index_pipeline.go
Chunking: internal/knowledge/splitter.go
Retriever: internal/knowledge/retriever.go
Native retrieval pipeline: internal/knowledge/retrieve_chain.go
Rerank: internal/knowledge/rerank_http.go
MCP tools: internal/knowledge/tool.go

2.6 KiB Raw Blame History