How GrapeBeaver works
The pipeline
1. Gather. Each source has its own connector and its own polling cadence. Advisories are normalized into one common shape and deduplicated — the same advisory cross-posted to three sources is ingested once.
2. Assess. An analysis agent produces one canonical summary and a HARP-CS-style impact score per item, against a fixed device-category taxonomy. This runs once globally, not once per subscriber.
3. Review. A person reads the agent's output, corrects it where needed, and approves or rejects it. Nothing reaches a subscriber before this step.
4. Match. Published items are matched against each organization's registered devices and SBOM components by CPE, package URL, vendor/product name, and category. This is a database query, not a model call.
5. Deliver. Digests assemble the canonical summary, or — on Business and Enterprise — a rewrite scoped to your matched devices.
Severity scoring
Scores map to four badges. Amber and red appear nowhere else in the product, so when you see one it means something.
| Badge | Score | When |
|---|---|---|
| Critical | 85–100 | Remotely exploitable without authentication, with plausible direct patient-safety impact. |
| High | 65–84 | Remotely exploitable or high impact, with a credible clinical or regulatory consequence. Class I recalls. |
| Medium | 40–64 | Requires adjacent access, authentication, or user interaction. Class II recalls. |
| Low | 0–39 | Informational or guidance-only; requires physical access; no clinical pathway. |
API (Enterprise)
Read access to intelligence items, your registered devices, portfolio matches, and personalized assessments — plus one write endpoint for match disposition, so a GRC or ticketing integration can close the loop. Keys are issued and revoked from your organization's settings page and are scoped to a single organization.
curl -H "Authorization: Api-Key gb_your_key_here" \ https://grapebeaver.dev/api/v1/matches/?open_only=true
SBOM upload
CycloneDX JSON 1.2 through 1.6 is parsed directly, including nested component trees — a vulnerability in a transitive dependency matters as much as one at the top level. A CSV with name, vendor, and version columns also works, for teams whose device list lives in a spreadsheet.