Blastradius

Project intro

Blastradius is a supply-chain vulnerability triage agent built around a FalkorDB graph. When a new CVE lands, it answers four questions directly: are we affected, through which dependency path, who owns the affected service, and what did we decide last time? Instead of ranking advisories by text similarity, it runs a graph traversal from advisory to package to service, and shows the exact chain — for example, a critical protobufjs RCE traced from an internet-facing frontend through checkout and payment services to protobufjs@6.11.4. When no path exists, that absence is itself the verdict: the tool returns NOT_AFFECTED with the empty traversal as evidence, as it does for Log4Shell against a Node/Go/Python stack. Verdicts come from deterministic rules over graph evidence; the optional language model only picks tools and phrases results, never writes Cypher and never sees database credentials. The same graph also stores ownership from CODEOWNERS, expertise from commit history, and past decisions linked to their source commits and PR discussions, so a later advisory for the same package can reuse an earlier playbook. Users can paste any public GitHub repository, and Blastradius resolves its transitive dependencies via deps.dev, queries OSV advisories, and builds a tenant graph; it also accepts CycloneDX/SPDX SBOM files and exports tenants as CycloneDX 1.5. A hosted demo is available, and the project also runs locally with Docker for $0. Honest limits, as stated by the author: the hosted demo runs on a small shared server with a free-tier Gemini quota shared by all visitors, and function-level reachability (govulncheck) is currently for Go services only.