First-pass triage of private vulnerability reports on GitHub. When a new security advisory comes in, tamis has an LLM agent investigate it against the repository and posts its findings as a comment on the advisory.

For each report, tamis:

lists public duplicates in the comment, and embargoed advisories only when they are exact duplicates, by identifier,

finds public issues and pull requests already fixing or hardening the same code,

checks that the files and functions the report cites exist,

reads the security policy and flags what may exclude the report,

suggests a CWE and a CVSS 4.0 base vector.

It informs the maintainers' decision and never makes it.

The agent runs in an isolated container driven by harness , the Alpha-Omega library behind scrutineer .…