> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Remediate vulnerabilities with AI

Implement with AI

Send this guide to your coding agent.

Prerequisite: Install Port MCP

A security vulnerability is a work item like any other ticket. It needs context, a routing decision, and often a coding agent to implement the fix. This guide applies Port's autonomous ticket resolution (ATR) pattern to vulnerabilities using a single Port workflow, so teams can move from a raw scanner finding to a merged fix without manual triage.

Security teams often face two critical challenges that slow down vulnerability remediation:

  1. Understanding vulnerabilities quickly - Raw scanner output is dense, technical, and rarely provides clear remediation steps.
  2. Acting fast enough - Even after analysis, fixing issues typically requires manual developer effort, leading to delays and higher risk exposure.

This guide demonstrates how to solve both problems with one event-triggered workflow. When a vulnerability is marked as critical, the workflow invokes an AI agent to enrich it with a clear summary and remediation steps, saves the analysis to the catalog, and dispatches your coding agent backend to generate a fix in a pull request.

Vulnerability triggering AI analyzer and Claude Code PR

Common use cases​

  • Automatically enrich critical vulnerabilities with plain-language impact and remediation guidance.
  • Trigger a coding agent to open a pull request with a proposed fix minutes after severity escalation.
  • Reduce time-to-remediation without manual handoffs between security and engineering teams.

Prerequisites​

Before you begin, ensure you have:

Set up data model​

First, you need to ensure your vulnerability blueprint includes an ai_summary property to store the AI-generated analysis.

  1. Go to the Data model page in Port.

  2. Search for the blueprint you want to update.

  3. Click on the {...} button in the top right corner, and choose Edit JSON.

  4. Add this JSON snippet to the properties of the blueprint:

    "ai_summary": {
      "type": "string",
      "title": "AI Analysis",
      "description": "AI-generated analysis and remediation steps",
      "format": "markdown"
    }

  5. Click Save.

Blueprint identifier

This guide uses securityVulnerability as the blueprint identifier in the workflow JSON. Change it to match your data model (e.g., snykVulnerability, wizIssue, or sonarQubeIssue).

Configure the service relation​

The workflow sends coding agent work to the GitHub repository that owns the vulnerable code. Every backend tab reads relations.service from the triggered vulnerability entity. For these steps to succeed, the service relation on your vulnerability blueprint must resolve to a GitHub repository identifier in org/repo format (for example port-labs/port-docs).

If vulnerabilities are not linked to a service yet:

  • In the Data model, add a service relation on your vulnerability blueprint pointing to your service blueprint.
  • Update your security integration mapping to set the relation during sync (often from project name, repository URL, or a project-to-service match).

Create your AI agent​

Create an AI agent that analyzes vulnerabilities. The workflow invokes this agent directly, it does not need access to self-service actions.

  1. Go to the AI Agents page in Port.

  2. Click on + AI Agent.

  3. Toggle Json mode on.

  4. Copy and paste the following JSON schema:

    Vulnerability enrichment agent (click to expand)
    {
      "identifier": "vulnerability_enrichment_agent",
      "title": "Vulnerability Enrichment Agent",
      "icon": "Vulnerability",
      "properties": {
        "description": "Provides remediation steps and mitigation strategies for vulnerabilities",
        "status": "active",
        "prompt": "You are an agent responsible for analyzing security vulnerabilities and providing actionable recommendations.\n\n### Guidelines\n- Summarize the vulnerability in simple terms.\n- Explain the potential impact if exploited.\n- Recommend step-by-step remediation strategies.\n- Suggest best practices to prevent similar vulnerabilities.\n- Tailor responses to the severity (Critical, High, Medium, Low).\n\nReturn your analysis as clear Markdown suitable for storage in a catalog property and for use by a coding agent that will implement the fix.",
        "execution_mode": "Automatic",
        "conversation_starters": [
          "Explain the impact of CVE-2025-1234",
          "Suggest a remediation plan for this SQL injection vulnerability",
          "What steps should I take to patch a high severity XSS issue?"
        ],
        "tools": [
          "^(list|search|track|describe)_.*"
        ]
      },
      "relations": {}
    }
    MCP enhanced capabilities

    The ^(list|search|track|describe)_.* pattern lets the agent read related entities from your context lake for richer vulnerability context.

  5. Click Create to save the agent.

Build the workflow​

When a vulnerability becomes critical, this workflow enriches it, saves the AI summary, and dispatches your coding agent to propose a fix.

Trigger customization

This workflow triggers when severity changes to critical. You can adapt the event trigger condition to match your policy, for example High or above, specific services, or newly created vulnerabilities.

Choose the workflow JSON that matches your coding agent:

Build the workflow

  1. Go to the Workflows page of your portal.

  2. Click on the + Workflow button in the top-right corner.

  3. In the Name field, enter Remediate critical vulnerability, then click Confirm.

  4. On the editor page, click the see workflow JSON button (the code icon) to open the JSON editor.

  5. Copy and paste the workflow JSON below to replace the example workflow:

    Remediate critical vulnerability workflow JSON for Claude Code (click to expand)
    {
      "identifier": "remediate_critical_vulnerability",
      "title": "Remediate critical vulnerability",
      "icon": "Vulnerability",
      "description": "Enrich critical vulnerabilities with AI analysis and dispatch Claude Code to propose a fix",
      "allowAnyoneToViewRuns": true,
      "nodes": [
        {
          "identifier": "trigger",
          "title": "On severity changed to critical",
          "icon": "Vulnerability",
          "description": "Trigger when a vulnerability severity changes to critical",
          "config": {
            "type": "EVENT_TRIGGER",
            "event": {
              "type": "ENTITY_UPDATED",
              "blueprintIdentifier": "securityVulnerability"
            },
            "condition": {
              "type": "JQ",
              "expressions": [
                ".diff.before.properties.severity != \"critical\"",
                ".diff.after.properties.severity == \"critical\""
              ],
              "combinator": "and"
            }
          },
          "variables": {}
        },
        {
          "identifier": "enrich_vulnerability",
          "title": "Analyze vulnerability with AI",
          "icon": "AI",
          "description": "Invoke the Vulnerability Enrichment Agent",
          "config": {
            "type": "AI_AGENT",
            "agentIdentifier": "vulnerability_enrichment_agent",
            "userPrompt": "Generate a summary and remediation steps for vulnerability with entity identifier {{ .outputs.trigger.diff.after.identifier }}. The issue has been updated with the following details: {{ .outputs.trigger.diff.after.properties | tojson }}"
          },
          "variables": {}
        },
        {
          "identifier": "save_ai_summary",
          "title": "Save AI summary",
          "icon": "Vulnerability",
          "description": "Update the vulnerability entity with the AI-generated analysis",
          "config": {
            "type": "UPSERT_ENTITY",
            "blueprintIdentifier": "securityVulnerability",
            "mapping": {
              "identifier": "{{ .outputs.trigger.diff.after.identifier }}",
              "properties": {
                "ai_summary": "{{ .outputs.enrich_vulnerability.response }}"
              }
            }
          },
          "variables": {}
        },
        {
          "identifier": "run_claude_code",
          "title": "Generate fix with Claude Code",
          "icon": "Code",
          "description": "Dispatch Claude Code to generate a fix and open a pull request",
          "config": {
            "type": "INTEGRATION_ACTION",
            "installationId": "<YOUR_GITHUB_OCEAN_INTEGRATION_ID>",
            "integrationProvider": "github-ocean",
            "integrationInvocationType": "dispatch_workflow",
            "integrationActionExecutionProperties": {
              "org": "<YOUR_GITHUB_ORG>",
              "repo": "<YOUR_WORKFLOW_REPO>",
              "workflow": "claude-backend.yaml",
              "workflowInputs": {
                "repo_name": "{{ .outputs.trigger.diff.after.relations.service }}",
                "command": "Here is the information about the security vulnerability: {{ .outputs.trigger.diff.after | tojson }}.\n\nGenerate a code fix for the issue based on the AI-provided summary:\n\n{{ .outputs.enrich_vulnerability.response }}\n\nAfter generating the code, open a PR with a description summarizing what was fixed and why."
              },
              "reportWorkflowStatus": true
            }
          },
          "variables": {}
        }
      ],
      "connections": [
        {
          "sourceIdentifier": "trigger",
          "targetIdentifier": "enrich_vulnerability"
        },
        {
          "sourceIdentifier": "enrich_vulnerability",
          "targetIdentifier": "save_ai_summary"
        },
        {
          "sourceIdentifier": "save_ai_summary",
          "targetIdentifier": "run_claude_code"
        }
      ]
    }

  6. Click Save to save the workflow.

Replace placeholders

Replace YOUR_GITHUB_OCEAN_INTEGRATION_ID, YOUR_GITHUB_ORG, and YOUR_WORKFLOW_REPO with your GitHub Ocean integration ID, organization name, and the repository where claude-backend.yaml lives.

Test your workflow​

Now it's time to test the complete vulnerability enrichment flow:

  1. Create or sync a vulnerability with severity set to Critical, or update an existing vulnerability's severity to critical.

  2. Port runs the workflow automatically when the severity change is detected.

  3. Verify the workflow run on the Workflow page. Confirm the trigger, AI analysis, save summary, and coding agent dispatch nodes completed successfully.

  4. Check the vulnerability entity in the catalog and confirm ai_summary was populated.

  5. Review the pull request or Copilot issue opened by your coding agent backend.

  6. Merge the PR to complete the remediation loop.

Claude Code pull request fixing CVE Alpine base image

What's next?​

Your automated security workflow is now complete. Here are some ways you can extend it:

  • Customize triggers: Adjust the event trigger condition based on your security policies.
  • Add approval steps: Insert a condition or manual gate before dispatching the coding agent.
  • Scale to other issue types: Apply the same pattern to bugs, performance issues, or compliance violations.