Runtime Correlation
runtime_correlateRead-onlyIdempotent
Cross-references vulnerability scans with proxy runtime logs to confirm which vulnerable tools were called, and processes OTel traces for ML API call provenance.
Instructions
Cross-reference vulnerability scan results with proxy runtime audit logs.
Identifies which vulnerable tools were ACTUALLY CALLED in production,
distinguishing confirmed attack surface from theoretical risk. Produces
risk-amplified findings: a vulnerable tool that was called 100 times is
higher priority than one never invoked.
Also accepts an OTel trace file (``otel_trace``) to extract ML API call
provenance: which models were called, token usage, and deprecation advisories.
Requires a proxy audit log (generated by running agent-bom proxy with
the --log flag). Without an audit log, returns scan results only.
Returns:
JSON with correlated findings (CVE + tool call data + amplified risk),
summary stats, uncalled vulnerable tools, and ml_api_calls provenance.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| config_path | No | Path to MCP config directory (e.g. ~/.config/claude) or 'auto' for default discovery. | auto |
| audit_log | No | Path to proxy audit JSONL log file (generated by 'agent-bom proxy --log audit.jsonl'). | |
| otel_trace | No | Path to OTel OTLP JSON trace file for ML API provenance (detects deprecated/vulnerable model versions). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |