remedify

remedify is a last-mile vulnerability remediation planner. Detection is a solved problem — plenty of scanners tell you what is vulnerable and which version fixes it. What every team gets stuck on next is "how do I actually run that fix, here, on this OS?" remedify answers that — deterministically, for whatever scanner you already run.

90-second walkthrough: a Trivy/Sysdig finding → remedify → the exact apt/dnf/apk command → rescan & verify. Re-record with demo/demo.sh.

After triage, every team hits the same wall: "so what exact command do I run, on this OS, for each of these?" — and today the answer is "go read the Ubuntu / RHEL / Amazon Linux docs, package by package, by hand."

remedify closes that last-mile gap. It takes vulnerability scan results (Trivy, Grype, OSV-Scanner, or Sysdig — API, JSON, and CSV) and generates concrete, distro-aware remediation:

$ trivy rootfs --format json -o scan.json /
$ remedify scan.json

## libssl3  `HIGH`
- Installed: `3.0.2-0ubuntu1.15` -> Fix: `3.0.2-0ubuntu1.18`
- CVEs: CVE-2024-5535, CVE-2024-6119
- **Vendor backport (Ubuntu)**: the fixed version is a distro backport — it will
  not match the upstream version number. Trust the vendor advisory below.

    apt-get install --only-upgrade libssl3=3.0.2-0ubuntu1.18

- ⚠️ Restart services that link against OpenSSL (nginx, sshd, etc.).
- Advisories: [Ubuntu USN](https://ubuntu.com/security/notices/USN-6986-1)

Why remedify

• It's its own category — not a scanner add-on. Input is abstracted across Trivy, Grype, OSV-Scanner, and Sysdig (JSON / CSV / API), plus an MCP server: the scanner is interchangeable, the plan is the product. remedify is not "a Trivy tool".

• Deterministic, never generative. remedify never asks an AI to invent a fix. Every command is derived from the scanner's fix version and distro packaging rules, so the same input always yields the same plan. AI's job is to explain the plan and wire it into your workflow — never to guess the patch. That division of labor is the durable differentiator, and why you can paste the output straight into a change ticket.

• Built for the people who triage findings — Security / SOC / vulnerability-management teams who need to hand developers or SREs the exact remediation, not another list of CVEs.

• Scope, honestly. copa patches container images in place; remedify tells you how to patch everything else — hosts, VMs, and images alike — and stops at the plan. It never applies changes itself.

Related MCP server: VulScan-MCP

Quick start

pip install remedify          # from PyPI
# or zero-install: git clone https://github.com/higakikeita/remedify && cd remedify

# 1. From Trivy
trivy image --format json -o scan.json nginx:latest
python3 remedify.py scan.json                             # Markdown report
python3 remedify.py scan.json --format shell > fix.sh     # reviewable fix script
python3 remedify.py scan.json --min-severity HIGH --format json   # for CI/automation

# Silence findings you've already triaged (kept out of the plan, listed as
# Suppressed with a reason — never silently dropped):
python3 remedify.py scan.json --vex openvex.json          # OpenVEX not_affected/fixed
python3 remedify.py scan.json --ignore .remedifyignore    # CVE- or package-scoped

# 2. Straight from the Sysdig VM API (needs a Secure API token)
export SYSDIG_API_TOKEN=<token>
python3 remedify.py --from-sysdig --api-url https://us2.app.sysdig.com
python3 remedify.py --from-sysdig --api-url ... --limit 20   # 20 workloads, one report

# 2b. From Grype or OSV-Scanner
grype myapp:1.0 -o json | python3 remedify.py -
osv-scanner --format json -r . | python3 remedify.py -

# 3. From a Sysdig vulnerability report CSV export
python3 remedify.py report.csv --os ubuntu:22.04

As a Trivy plugin

Run remedify directly from Trivy — findings flow straight into a remediation plan:

trivy plugin install github.com/higakikeita/remedify

# Trivy scans, then pipes the report to remedify (output-plugin mode):
trivy image --format json --output plugin=remedify nginx:latest

# pass remedify flags through --output-plugin-arg:
trivy image --format json --output plugin=remedify \
  --output-plugin-arg "--format=shell" nginx:latest > fix.sh

# or hand it a saved scan:
trivy remedify scan.json

Zero-dependency: the plugin is the same single Python file, so it installs on any platform without a build step.

No dependencies — any Python 3.9+ runs it as-is.

Why not just use copa?

Copacetic is excellent — for container images. It patches an image directly by adding a patch layer, no rebuild needed. remedify covers what copa doesn't:

They are complementary: containers with a registry workflow → copa; hosts, language packages, and automation pipelines → remedify.

Features

• Inputs (auto-detected): Trivy JSON (trivy image|fs|rootfs --format json), Sysdig scan-result JSON (sysdig-cli-scanner / VM API), Grype JSON, OSV-Scanner JSON, Sysdig vulnerability report CSV exports (header names matched flexibly — pass --os ubuntu:22.04 if your export lacks an OS column), or live from the Sysdig VM API (--from-sysdig --api-url https://us2.app.sysdig.com with SYSDIG_API_TOKEN; validated against a live tenant)

• Priority signals: findings carry Sysdig runtime context — 🚨 CISA KEV (known exploited), public exploit available, and package in use at runtime — and steps are sorted by severity + these signals, so you fix what attackers can actually reach first

• Application dependencies (lang-pkgs): Java/npm/pip/Go/Ruby/PHP/Rust/.NET findings get ecosystem-specific fix instructions (update pom.xml / npm install pkg@ver / etc. + rebuild) — the class of finding neither OS package managers nor copa can fix

• Distro-aware commands: apt (Ubuntu/Debian), dnf/yum (RHEL/Rocky/Alma/Amazon/Fedora), apk (Alpine), zypper (SUSE)

• Consolidated steps: binary packages from one source package (e.g. e2fsprogs + libcom-err2 + libext2fs2 + libss2) become one command, not four

• "No fix available" section: findings without a fixed version are reported with their vendor status (affected, will_not_fix, end_of_life) — never silently dropped

• EOL awareness: detects end-of-life distro versions and warns when fixes require ESM enrollment or an OS migration

• Backport detection: flags vendor backports (~ubuntu, .el9, .amzn2, +esm, +deb) and explains why the version won't match upstream

• Operational hints: kernel → reboot required; glibc → reboot recommended; OpenSSL → restart linked services

• Advisory surfacing: vendor sources first (USN, RHSA, ALAS, DSA), NVD as fallback, near-duplicates collapsed

• Three output formats: Markdown report, executable shell script, JSON

• Zero dependencies: single-file Python, stdlib only

What you get

1. A prioritized Markdown report — consolidated steps instead of per-package noise:

# Remediation plan: `prod-web-host (ubuntu 18.04)`

- **Remediation steps**: 1 (covering 4 packages)
- **No fix available**: 1 packages

> ⚠️ **EOL**: Ubuntu 18.04 standard repositories no longer receive security
> updates. Fixes for many CVEs require Ubuntu Pro (ESM).

## e2fsprogs (+3 related packages)  `MEDIUM`

- Packages: `e2fsprogs`, `libcom-err2`, `libext2fs2`, `libss2` (same source, one update)
- Installed: `1.44.1-1ubuntu1.1` -> Fix: `1.44.1-1ubuntu1.2`
- **Vendor backport (Ubuntu)**: fixed version won't match upstream — trust the advisory.

    apt-get install --only-upgrade e2fsprogs=1.44.1-1ubuntu1.2 libcom-err2=1.44.1-1ubuntu1.2 ...

- Advisories: [Ubuntu USN](https://ubuntu.com/security/notices/USN-4142-1)

## No fix available

- **bash** `LOW` (CVE-2019-18276) — No vendor fix released yet

2. A reviewable shell script (--format shell) — commented, set -euo pipefail, reboot reminder at the end:

#!/usr/bin/env bash
# Review before running. Run as root or with sudo.
apt-get update

# e2fsprogs, libcom-err2, ... 1.44.1-1ubuntu1.1 -> 1.44.1-1ubuntu1.2 [MEDIUM] CVE-2019-5094
#   NOTE: Ubuntu vendor backport — version differs from upstream
apt-get install --only-upgrade e2fsprogs=1.44.1-1ubuntu1.2 ...

3. Machine-readable JSON (--format json) — feed it to your ticketing system, chatbot, or AI agent.

Use from AI agents (MCP)

remedify ships an MCP server (remedify_mcp.py, zero dependencies) so AI agents get deterministic remediation plans instead of generating their own commands. Claude Desktop config:

"mcpServers": {
  "remedify": {
    "command": "python3",
    "args": ["/path/to/remedify/remedify_mcp.py"],
    "env": { "SYSDIG_API_TOKEN": "..." }
  }
}

Tools: generate_remediation_plan (pass scan content) and fetch_sysdig_plan (live from the Sysdig VM API, with fleet summary). The agent reasons and talks; remedify computes the plan — same input, same output, every time.

Security note: MCP tool arguments are assembled by the agent, so the server never reads arbitrary local paths. scan_content is the recommended input. scan_path is disabled unless you set REMEDIFY_MCP_ALLOWED_DIR, and even then only reads files that resolve inside that directory.

CLI reference

Input via file path or stdin (-).

Supported distros

Try it with the bundled examples:

python3 remedify.py examples/trivy-real-ubuntu1804.json   # real Trivy output: grouping + EOL + no-fix
python3 remedify.py examples/trivy-rhel.json --min-severity HIGH
python3 remedify.py examples/trivy-amazon2.json           # yum + ALAS advisories
python3 remedify.py examples/trivy-alpine.json            # apk
python3 remedify.py examples/trivy-centos7-eol.json       # EOL + will_not_fix / end_of_life
python3 remedify.py examples/sysdig-report.csv           # Sysdig CSV export
python3 remedify.py examples/sysdig-scan-result.json     # Sysdig scan JSON: OS + Java/npm (Spring4Shell)
python3 remedify.py examples/trivy-ubuntu.json --format shell > fix.sh

Architecture

 scan results        parser          normalized        generators          renderers
┌────────────┐   ┌───────────┐   ┌──────────────┐   ┌──────────────┐   ┌────────────┐
│ Trivy JSON │──▶│  one per  │──▶│ Finding      │──▶│ apt / dnf /  │──▶│ markdown   │
│ Grype JSON │   │  scanner  │   │  pkg,        │   │ apk / zypper │   │ shell      │
│ OSV/Sysdig │   │           │   │  fix ver,    │   │ + backport   │   │ json       │
└────────────┘   └───────────┘   │  CVEs, refs  │   │ + hints      │   │ sarif 🔜   │
                                 └──────────────┘   └──────────────┘   └────────────┘

Each stage is pluggable: new scanners are parsers, new distros are generators, new outputs are renderers.

Roadmap

Shipped

• Inputs: Trivy, Grype, OSV-Scanner, and Sysdig (scan JSON, report CSV, and Vulnerability Management API)

• Language packages: pip/npm/Maven/Go/etc. findings surfaced as upgrade-and-rebuild steps (OS package managers can't fix them)

• Outputs: markdown, shell script, JSON, Ansible playbook

• verify: closed-loop before/after diff — proof a fix actually landed, with a CI gate (--fail-on)

• Suppression: OpenVEX (--vex) and ignore-lists (--ignore) keep already-triaged findings out of the plan — decided mechanically, never by an AI, and surfaced with their reason (never silently dropped)

• EOL detection and prioritization (in-use / exploitable / KEV)

• MCP server (remedify_mcp.py) so AI agents can call it

• Trivy plugin: trivy remedify / --output plugin=remedify

Next

• Enrichment: query vendor security data (Ubuntu OVAL/USN, Red Hat CSAF/errata, ALAS) for "not affected / needs-restart" precision

• Integration: GitHub Action, --format sarif

• Windows: KB articles / winget

• Rewrite in Go once the interface stabilizes (single static binary, same ecosystem as copa/trivy)

Non-goals

• remedify does not apply patches. It generates the plan; a human (or your automation) executes it. Auto-apply is deliberately out of scope for v0.x.

• Not a scanner. Bring your own (Trivy/Grype/Sysdig).

Status

Alpha — usable today, interfaces may change before v1.0. Published on PyPI (pip install remedify) with a comprehensive test suite (190+ tests, property tests against real dpkg, fuzzing, and schema canaries). Feedback and contributions welcome — see CONTRIBUTING.md.

License

Apache-2.0.