AI-powered CVE monitoring system that tracks high-risk vulnerabilities, classifies RCE threats using a two-tier approach (rule-based + LLM), and provides natural language querying via web UI and Telegram bot.
Author: Nachum Getzel Elkind
| Layer | Technologies |
|---|---|
| Backend | Python 3.12, FastAPI, SQLAlchemy 2.0 (async), SQLite with WAL mode |
| Frontend | React, Vite, TypeScript, Tailwind CSS, shadcn/ui |
| AI | LiteLLM (unified API for OpenAI/Anthropic/etc.), GPT-4o for classification and summarization |
| Telegram | aiogram 3.x — bot interface and push notifications |
| Config | YAML + Pydantic validation, secrets in .env |
SQLite was chosen for zero-config deployment in a POC context. WAL mode enables concurrent reads during ingestion. The async SQLAlchemy layer abstracts the database engine — switching to PostgreSQL for production requires a single config change (sqlite+aiosqlite → postgresql+asyncpg), no code modifications.
LiteLLM provides a single API across 100+ LLM providers with built-in cost tracking per call. Models can be swapped via configuration without code changes.
Tier 1 — Pattern Matching (free, instant): Keyword match ("remote code execution", "arbitrary code") and CWE+NETWORK vector combinations. Sets is_rce_native = True only when 100% certain.
Tier 2 — AI Classification (GPT-4o): Runs on every CVE where Tier 1 didn't find RCE. If Tier 1 already confirmed RCE, AI is skipped to save cost. The AI returns a confidence score — above 0.7 sets is_rce_ai_classified = True. Both flags are stored separately for auditability.
The goal is to never miss an RCE. We accept higher LLM costs in exchange for better recall.
Users ask natural language questions ("Which Linux RCEs were added this week?"). The LLM uses OpenAI function/tool calling to query the database with 5 tools: query_cves, get_cve_details, run_sql_query, run_sql_write, and get_statistics.
Write operations require explicit user confirmation — a separate LLM call explains the SQL in plain language before the user decides.
# Install
python -m venv .venv && source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -e .
cd frontend && npm install && npm run build && cd ..
# Configure
# Create .env with: OPENAI_API_KEY, TELEGRAM_BOT_TOKEN, NVD_API_KEY (optional)
# Run
cve-sentinel fetch --days 7 # Initial data load
cve-sentinel run --port 8000 # Start everythingWeb UI at http://localhost:8000. Telegram bot responds to /start. Scheduler auto-fetches every 5 minutes.
pytest -v # 98 tests — config, DB, RCE classifier, NVD parsing, notifications, chat safety, API endpoints, integration