rawlings/Autoremediator

Agentic CVE remediation for Node.js dependencies. Runs version-bump remediation for scanner output or a single CVE ID, with LLM patch-generation fallback when no safe version exists, and integrates with MCP/OpenAPI security automation workflows.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 16, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: rawlings/autoremediator@3becd8d335d9c7f8bdad564e30bd2fbdb0006ae4 # v0.15.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
scan-file	Path to scanner output file (npm audit --json, pnpm audit --json, yarn audit --json, bun audit --json, or SARIF). Mutually exclusive with cve-id. Mutually exclusive with audit. Required if cve-id and audit are not set.	no	—
audit	Run a package-manager-native audit command instead of reading scan-file. Mutually exclusive with scan-file and cve-id. Uses npm directly and enables Corepack shims for pnpm and yarn audit mode.	no	false
cve-id	Single CVE ID to remediate directly (e.g. CVE-2021-23337). Mutually exclusive with scan-file and audit. Required if scan-file and audit are not set.	no	—
format	Scanner input format. One of: auto, npm-audit, yarn-audit, sarif. Ignored when cve-id is set.	no	auto
cwd	Target project directory containing package.json and lockfile. Defaults to repository root.	no	.
package-manager	Package manager to use for installs: npm, pnpm, yarn, bun, or deno. Auto-detected from lockfile if not set.	no	—
dry-run	Plan changes only — do not mutate files or run installs.	no	false
run-tests	Run the package-manager test command to validate changes after applying.	no	false
ci	Enable CI mode — exit non-zero when any CVE is unresolved after remediation attempts. Ignored when cve-id is set.	no	false
summary-file	Write a machine-readable scan summary JSON to this path. Useful for downstream steps and artifact upload. Ignored when cve-id is set.	no	—
policy	Path to a policy file (.github/autoremediator.yml) that controls upgrade constraints, allow/deny lists, and remediation behavior.	no	—
llm-provider	LLM provider for patch-generation fallback when no safe version exists. One of: remote, local. local runs deterministic mode and does not require remote credentials.	no	local
node-version	Node.js version to use. Must be 24 or higher.	no	24
token	GitHub token for PR creation. Defaults to github.token.	no	${{ github.token }}
create-pull-request	Open a pull request with remediated changes.	no	false
pull-request-branch	Branch name prefix for the fix branch.	no	—
pull-request-title	Title for the pull request.	no	—
pull-request-commit-message	Commit message for remediation commits.	no	—
update-outdated	Run update-outdated mode: bump all outdated npm packages to their latest versions without requiring a CVE ID. Cannot be combined with cve-id or scan-file.	no	false
include-transitive	Include indirect/transitive dependencies in the outdated check. Only applicable when update-outdated is true.	no	false
containment-mode	Halt the pipeline when any result disposition is not auto-apply. Use with dry-run to enforce hold-for-approval gates.	no	false
simulation-mode	Populate planned mutation metadata and rebuttal findings without applying any changes. Requires dry-run. Valid for cve-id and scan modes.	no	false
offline	Skip all network calls to intelligence sources (OSV, GitHub Advisory, NVD, CISA-KEV, EPSS). Version-bump remediation still works if the npm registry is accessible.	no	false
intelligence-snapshot	Path to a local JSON file containing pre-fetched CVE intelligence, keyed by CVE ID. Used with offline: true to provide CVE data without network access.	—	—

Outputs

name	description
summary-file	Path to the generated summary JSON file (if summary-file input was set).
pull-request-url	URL of the created pull request, if any.