Mental Model

Overview

One Python upload is easiest to hold as five layers. AI sits in Scan and Review; Accept, Stage, and Deliver are product and API steps. Anthropic names from Building effective agents (PDF).

Applied workflows

• Prompt Chaining. Security Researcher must call Semgrep once (config: auto), then review those findings, then run its own pass for gaps, then emit a typed SecurityReport.
• Not used here (yet). Routing, Parallelization, Orchestrator-Worker, Evaluator-Optimizer.

Layers

• 1 Accept. Developer picks a .py file in the UI; empty code is rejected before any agent run.
• 2 Stage. API writes the source to a temp .py path so Semgrep can read a real file.
• 3 Scan. Agent calls semgrep_scan once over MCP stdio (config: auto, 60s timeout).
• 4 Review. Agent combines Semgrep hits with its own analysis of issues Semgrep may have missed; output is a structured SecurityReport.
• 5 Deliver. API sorts issues by CVSS descending, prepends character count to the summary, deletes the temp file, returns JSON to the UI.

Layer map

Layer stack for one upload. Diagram key: ✦ AI agent · second line = Anthropic workflow · purple = actor · white = service.

---
config:
  theme: default
  themeVariables:
    background: "#ffffff"
    fontSize: "14px"
---
flowchart TB
    person[Developer]
    accept["1 Accept
upload .py"]
    stage["2 Stage
temp file"]
    scan["✦ 3 Scan
Prompt Chaining"]
    review["✦ 4 Review
Semgrep plus gaps"]
    deliver["5 Deliver
sorted JSON"]

    person -->|POST api analyze| accept --> stage
    stage --> scan --> review --> deliver
    deliver --> person

    classDef agent fill:#e8f0ee,stroke:#0f3d36,stroke-width:2px,color:#0d0d0d
    classDef service fill:#fafaf8,stroke:#c8c8c2,stroke-width:1px,color:#0d0d0d
    classDef actor fill:#f3eef8,stroke:#6b4f9a,stroke-width:2px,color:#0d0d0d
    class scan,review agent
    class accept,stage,deliver service
    class person actor

Read layers top to bottom; drill into Security Researcher for tools and prompts.