README.md

---
title: FlashTriage
emoji: 😻
colorFrom: red
colorTo: yellow
sdk: docker
app_port: 7860
short_description: Scanner findings in. Triaged in seconds.
---


# ⚡ FlashTriage

**Scanner findings in. Triaged in seconds.** A multi-agent security-triage swarm on
**Gemma-4-31B + Cerebras**. Your 29 scanners already find the issues — FlashTriage
triages the firehose fast enough to run on *every* scan.

Built for the Cerebras × Google DeepMind Gemma 4 hackathon. Plays Track 1
(Multiverse Agents) and Track 3 (Enterprise Impact) with one build.

## The thesis: speed is the product
Naive multi-agent triage = many sequential LLM calls = slow. FlashTriage fans the
analyst agents out concurrently and lets Cerebras' throughput collapse the wall-clock
to ~one call. The homepage is a **live race**: Cerebras (parallel) vs a sequential
baseline, findings streaming in real time, ending in an `N× faster` verdict.

## The swarm (4 specialist roles, all Gemma-4 on Cerebras)
- **Analyst** — fan-out, per finding → CVSS, exploitability, false-positive likelihood (real risk, not the scanner's raw label).
- **Remediator** — conditional, per High/Critical → smallest correct fix + one-line patch hint.
- **Commander** — once, over the batch → executive rollup + prioritized actions.
- **Vision RCA** — multimodal, on demand → drop a screenshot of code/dashboard/alert → root cause + patch.

## Run it
```bash
cp .env.example .env          # add CEREBRAS_API_KEY
pip install -r requirements.txt
uvicorn backend.main:app --port 8000
# open http://localhost:8000
```
No key yet? Set `USE_MOCK=1` to rehearse the whole UI offline (simulated latency keeps
the race honest). Flip the key in for the real numbers.

## Decoupled from your scanners
`backend/models.py` normalizes **SARIF** (Semgrep/CodeQL/Trivy/Bandit…), **generic JSON**
(custom scanners), or **raw text** into one Finding shape. Point any of your 29 tools at
it — paste output, upload a file, or wire its JSON straight in.

## Honest baseline (your RTX 5090 vs Cerebras)
The strongest, most relatable side-by-side: run the baseline lane on **Ollama on your
own RTX 5090**. Set in `.env`:
```
BASELINE_BASE_URL=http://localhost:11434/v1
BASELINE_API_KEY=ollama
BASELINE_MODEL=gemma2
BASELINE_LABEL=RTX 5090 · Ollama
```
The contrast is real and brutal: FlashTriage fans the swarm out concurrently, so Cerebras
serves the whole batch in parallel while a single local GPU has to queue every call. The
verdict line names whichever baseline is live, so nothing is misrepresented. Leave the
baseline blank and it falls back to the same Cerebras model run sequentially (still fair —
it isolates throughput + parallel fan-out). The client is provider-aware: Cerebras gets
strict `json_schema` constrained decoding + `reasoning_effort`; Ollama gets `json_object`
and the Cerebras-only params are dropped so the request never chokes.

## Backlog scale (bonus)
`python -m backend.batch_triage huge_scan.json` triages up to 50k findings via the Cerebras
**Batch API** (async, guaranteed < 24h). Real-time race for interactive work; Batch for the
overnight backlog. (Batch is Private Preview — needs to be enabled for your org.)

## Layout
```
backend/cerebras_client.py   provider-aware OpenAI-compatible client (Cerebras + Ollama), timing, image, mock
backend/models.py            scanner-output adapters (SARIF / JSON / text)
backend/agents.py            the swarm + concurrent batch orchestration (the speed engine)
backend/main.py              FastAPI: SSE triage stream + multimodal deep-dive
backend/batch_triage.py      optional: Cerebras Batch API for 50k-finding backlogs
frontend/index.html          the operator console (single file, vanilla JS, no build step)
samples/sample_findings.json realistic mixed-scanner batch for the demo
```