doc-intelligence-agent

Extract security context from repository documentation by analyzing README files, Dockerfiles, Helm, and Terraform templates to produce structured profiles for vulnerability validation. This generates doc-profile.json and doc-summary.md as evidence to confirm or downgrade scanner findings.

Repository documentation analysis reduces false-positive vulnerability findings by extracting authoritative product identity, architecture, and deployment context from docs. This security context profile allows teams to accurately validate, downgrade, or confirm scanner results during assessments.

Documentation profiles generate PR-ready remediation reports for GitHub repositories by mapping tech stack, authentication, and encryption controls from docs into structured evidence. The doc-summary.md output supports executive reporting and remediation workflows directly.

You need pyyaml installed to analyze OpenAPI routes and deployment templates for security assessments. The automated analysis script parses YAML configurations from Helm and Terraform files to map operational controls and security architecture.

Automated documentation analysis limitations include requiring agent judgment for external docs and final evidence curation. Phases 1 through 6 run automated via scripts, but phases 7 and 8 need human-in-the-loop review for accurate vulnerability context adjustments.