README.md

metadata

title: FlashTriage
emoji: 😻
colorFrom: red
colorTo: yellow
sdk: docker
app_port: 7860
short_description: Scanner findings in. Triaged in seconds.

⚡ FlashTriage

Scanner findings in. Triaged in seconds. A multi-agent security-triage swarm on Gemma-4-31B + Cerebras. Your 29 scanners already find the issues — FlashTriage triages the firehose fast enough to run on every scan.

Built for the Cerebras × Google DeepMind Gemma 4 hackathon. Plays Track 1 (Multiverse Agents) and Track 3 (Enterprise Impact) with one build.

The thesis: speed is the product

Naive multi-agent triage = many sequential LLM calls = slow. FlashTriage fans the analyst agents out concurrently and lets Cerebras' throughput collapse the wall-clock to ~one call. The homepage is a live race: Cerebras (parallel) vs a sequential baseline, findings streaming in real time, ending in an N× faster verdict.

The swarm (4 specialist roles, all Gemma-4 on Cerebras)

• Analyst — fan-out, per finding → CVSS, exploitability, false-positive likelihood (real risk, not the scanner's raw label).
• Remediator — conditional, per High/Critical → smallest correct fix + one-line patch hint.
• Commander — once, over the batch → executive rollup + prioritized actions.
• Vision RCA — multimodal, on demand → drop a screenshot of code/dashboard/alert → root cause + patch.

Run it

cp .env.example .env          # add CEREBRAS_API_KEY
pip install -r requirements.txt
uvicorn backend.main:app --port 8000
# open http://localhost:8000

No key yet? Set USE_MOCK=1 to rehearse the whole UI offline (simulated latency keeps the race honest). Flip the key in for the real numbers.

Decoupled from your scanners

backend/models.py normalizes SARIF (Semgrep/CodeQL/Trivy/Bandit…), generic JSON (custom scanners), or raw text into one Finding shape. Point any of your 29 tools at it — paste output, upload a file, or wire its JSON straight in.

Honest baseline (your RTX 5090 vs Cerebras)

The strongest, most relatable side-by-side: run the baseline lane on Ollama on your own RTX 5090. Set in .env:

BASELINE_BASE_URL=http://localhost:11434/v1
BASELINE_API_KEY=ollama
BASELINE_MODEL=gemma2
BASELINE_LABEL=RTX 5090 · Ollama

The contrast is real and brutal: FlashTriage fans the swarm out concurrently, so Cerebras serves the whole batch in parallel while a single local GPU has to queue every call. The verdict line names whichever baseline is live, so nothing is misrepresented. Leave the baseline blank and it falls back to the same Cerebras model run sequentially (still fair — it isolates throughput + parallel fan-out). The client is provider-aware: Cerebras gets strict json_schema constrained decoding + reasoning_effort; Ollama gets json_object and the Cerebras-only params are dropped so the request never chokes.

Backlog scale (bonus)

python -m backend.batch_triage huge_scan.json triages up to 50k findings via the Cerebras Batch API (async, guaranteed < 24h). Real-time race for interactive work; Batch for the overnight backlog. (Batch is Private Preview — needs to be enabled for your org.)

Layout

backend/cerebras_client.py   provider-aware OpenAI-compatible client (Cerebras + Ollama), timing, image, mock
backend/models.py            scanner-output adapters (SARIF / JSON / text)
backend/agents.py            the swarm + concurrent batch orchestration (the speed engine)
backend/main.py              FastAPI: SSE triage stream + multimodal deep-dive
backend/batch_triage.py      optional: Cerebras Batch API for 50k-finding backlogs
frontend/index.html          the operator console (single file, vanilla JS, no build step)
samples/sample_findings.json realistic mixed-scanner batch for the demo