Triage with AI Beta
Triage with AI lets your AI assistant decide whether what Levo found is real. It pulls the evidence for each vulnerability or finding from Levo, works out whether it is a true positive or a false positive, and tells you why, citing the request and response that decide it.
It works on everything Levo raises:
One vulnerability, or a selection of up to 25 from the Vulnerabilities page.
Passive findings, judged against the captured traffic each one was raised from.
A whole web application scan: what it covered, how it was configured and which of its results are real.
Every open vulnerability from a security test run, or from an application.
How it works
The analysis runs in your own AI assistant (Claude, ChatGPT, Cursor, VS Code Copilot, Codex, Gemini CLI and others), connected to Levo through the Levo MCP server.
- In Levo, click Triage with AI. Levo copies a ready-made prompt that names exactly what to triage.
- Paste it into your assistant.
- The assistant loads Levo's triage method, fetches the evidence through the MCP server, and answers with a verdict for each item and the evidence behind it.
Levo's triage method is a skill served by the MCP server, so every assistant follows the same steps: where the evidence came from, what it can and cannot prove, the common false-positive patterns for each weakness class, and how to report the answer.
Before you start
- Connect the Levo MCP server to your AI assistant. Follow Connect your AI assistant, or open Administration → Levo MCP Server in the Levo app for instructions with your region and organization filled in.
- Have the triage skills enabled for your organization. If the assistant replies that a triage skill is not enabled, contact support@levo.ai.
- Have permission to update vulnerabilities. The Triage with AI button appears only for users whose role can change a vulnerability's status.
Triage from the Levo app
Pick what to triage. Click Triage with AI on any of these:
| Where | What gets triaged |
|---|---|
| A vulnerability's page | That vulnerability |
| Vulnerabilities list, with rows selected | The selected vulnerabilities (up to 25) |
| A security test run's page | The run's unresolved vulnerabilities (up to 25) |
| An application's Security tab | The application's unresolved vulnerabilities (up to 25) |
| Findings list, a finding or a selection | The selected passive findings (up to 25) |
| A DAST scan's page | The whole scan: coverage, configuration, findings and vulnerabilities |
| A DAST scan's Findings tab | The scan's passive findings |
Paste the prompt into your assistant. Levo copies it to your clipboard. You do not need to edit it.
Read the verdicts. For each item the assistant says whether it is a true positive, a false positive, or unproven, and quotes the evidence. A DAST scan gets a single report that starts with what the scan actually covered, because a scan that barely crawled the application is not a clean result.
Record the outcome, if you want to. Ask the assistant to mark a false positive as Ignored or to add a comment with its reasoning. It shows you the change and waits for your go-ahead before writing anything back to Levo. You can also update the status yourself in the Levo app.
Triage from your assistant
You do not have to start in the Levo app. Once the MCP server is connected, ask in plain language:
- "Triage vulnerability 1234 in Levo and tell me if it's a false positive."
- "Go through the open vulnerabilities from last night's test run on the payments app."
- "Review the latest DAST scan of staging. Did it actually cover the application?"
- "Are the PII findings on
GET /users/{id}real? Check the traces."
In Claude Code, Cursor and Gemini CLI, the Levo plugin also adds a /levo-triage command.
What the assistant can see and change
- It acts as you, with your Levo role. It can read and change only what your account can.
- It does not change anything on its own. Status changes and comments happen only after you approve them, and your client asks you to confirm each tool call unless you have allowed it automatically.
- The evidence it reads, such as captured requests and responses, is sent to your AI provider. Connect only assistants your company allows for this data. See Data handling and privacy.
The assistant shows its evidence so you can check it. Review a verdict before you close or ignore a vulnerability, especially a high-severity one.
Troubleshooting
| The assistant says | What to do |
|---|---|
| It can't reach the Levo MCP server | Connect the server in your assistant: see Connect your AI assistant. Then paste the prompt again. |
| The MCP server is connected but doesn't serve a tool it needs | Your MCP server is out of date. Contact support@levo.ai. |
| The organization doesn't have a triage skill enabled | Contact support@levo.ai to enable it. |
| The selection is too large | Select at most 25 items per prompt and triage the rest in another batch. |