Evolving toward neuro-symbolic AI

See the dependency path behind every software risk.

Import CycloneDX SBOMs, enrich packages with complete OSV advisories, and explore applications, vulnerabilities, fixes, evidence, and dependency paths from one shared knowledge graph. The platform is moving toward neuro-symbolic AI—combining deterministic graph reasoning with grounded language-model intelligence.

Get started Watch Explore demo

Graph: Source of truth
OSV: Advisory enrichment
Neuro-symbolic: AI direction

Dependency Risk Graph application showing software supply-chain risk data

Java 25 Spring Boot 4.1.0 Knowledge graph CycloneDX 12.2.0 React 19.1 D3 7.9.0 LangChain4j 1.17.2

Video demo

See Dependency Risk Graph in action.

Follow the workflow from application exploration to vulnerability evidence and dependency-path analysis.

What it does

One graph, from SBOM to remediation.

Ingestion and enrichment build the graph. Explore, SPARQL, CVE Impact, and AI Workbench read the persisted model without hidden OSV calls.

Ingest CycloneDX

Preserve component identities and declared dependency edges while transforming SBOM content into connected graph data.

CycloneDX JSON

Enrich with OSV

Batch-query installed PURLs, load complete advisories, and connect affected package occurrences to normalized vulnerability resources.

Explicit writes

Explore CVE impact

Center a CVE between impacted application paths and provided fixes, with merged nodes and animated exposure highlighting.

D3 + SVG

Read complete CVSS

Parse version-specific vectors into calculated severity, scores, and clean metric tables instead of displaying an opaque vector alone.

V2 · V3 · V3.1 · V4

Query the graph

Run read-only SPARQL SELECT queries with presets, formatting, tabular results, CSV export, and direct access to graph relationships.

SPARQL + ARQ

Inspect AI evidence

Build typed advisory chunks, generate local BGE embeddings, and inspect the exact semantic evidence used by Buggy.

Grounded retrieval

Product tour

Follow risk from ingestion to evidence.

01 · Build the graph

Ingest an SBOM and inspect live graph totals.

Upload a CycloneDX JSON document, follow ingestion progress, and see application, package, dependency-edge, statement, and graph-node totals from the persisted model.

Dependency Risk Graph overview and CycloneDX ingestion screen — Overview and CycloneDX ingestion

02 · Understand scope

Application overview

Review direct and transitive dependencies, graph size, vulnerable packages, and vulnerability totals for the selected application.

03 · Inspect packages

Dependency inventory

Separate direct packages from transitive packages and inspect the immediate graph context of each installed dependency.

Explore dependencies screen — Direct and transitive dependencies

04 · Review advisories

Move from vulnerability rows to complete advisory detail.

Join installed packages to normalized OSV advisories, then open the complete advisory content, affected versions, fixes, CVSS data, timestamps, and references.

Explore vulnerabilities screen — Application vulnerability inventory

Vulnerability advisory details dialog — Complete advisory details

05 · Trace sources

Keep advisory references connected to affected packages.

References remain dedicated graph resources and are grouped by advisory alongside the installed package versions they describe.

Explore vulnerability references screen — References grouped by advisory

06 · Explain CVE impact

Start with cross-application scope, then follow the exact path to a fix.

Group one vulnerability across applications, center it between impacted dependency paths and provided fixes, and open focused node or advisory detail without losing context.

Cross-application CVE impact list — Grouped CVE impact list

CVE impact graph with vulnerability details — Graph context with focused advisory data

07 · Query the graph

SPARQL workbench

For developers, researchers, and graph practitioners

Run read-only SPARQL queries to inspect relationships, validate the graph model, and export custom results.

SPARQL query editor and result table — SPARQL query and results

08 · Inspect grounding

AI Workbench evidence

Review Buggy's summary beside ranked advisory chunks, source identifiers, similarity scores, and complete evidence text.

AI Workbench advisory evidence screen — Inspectable semantic evidence

Current architecture

Symbolic reasoning meets grounded AI.

Neuro-symbolic integration · In progress

Explicit ingestion builds one authoritative knowledge graph. Deterministic services, neural retrieval, and a tool-using agent expose that shared model through the UI.

Explicit write pipelinesSupply-chain sources become connected graph data

CycloneDX SBOM ingestion JSON → assemblers → graph document

OSV Advisory enrichment Scan plan → batch + detail → advisory graph

Converge Graph document parser Explicit writes into one default graph

Symbolic knowledge and reasoningAuthoritative identities, relationships, and deterministic traversal

Shared source of truth Knowledge graph Connected supply-chain intelligence

Explore + CVE Impact Read-only SPARQL Dependency-path projections Application GraphQL service Impacted-applications tool Advisory evidence projection

Neural retrieval and generationTwo implemented, independently callable AI paths

Evidence path Typed chunks → quantized BGE embeddings

In-memory similarity search supplies ranked advisory evidence to the configured chat model.

Evidence-grounded answer service

Agent path LangGraph4j token-aware Buggy workflow

Read-only GraphQL results are routed directly when they fit, or reduced through bounded JSONL evidence chunks before final synthesis.

Conditional StateGraph · LangChain4j · Groq

Current boundary: the agent and evidence-answer service are separate flows. Their integration into one traceable neuro-symbolic workflow is in progress.

Application interfacesHuman and developer access to the same graph-backed services

Spring MVC APIs Spring GraphQL React + Material UI GraphiQL Playground D3/SVG impact tree

Graph traversal

Affected-package relationship

Explore follows direct and transitive dependency occurrences, then reads the persisted vulnerability relationship on the affected package.

ApplicationOccurrence
    │
    └── risk:dependsOn
            ▼
     PackageOccurrence
            │
            ├── risk:dependsOn
            │       ▼
            │  PackageOccurrence
            │
            └── risk:affectedBy
                    ▼
              Vulnerability

The graph is authoritative

No second vulnerability database is maintained for Explore.

Writes are explicit

Opening an application never silently invokes OSV enrichment.

Reads are scoped

Application views follow persisted dependency relationships from the selected occurrence.

Grounding is explicit

Buggy uses graph tools, while evidence answers retain source text, identifiers, and scores.

Quick start

From clone to graph.

Build locally with Maven or use Docker to package the frontend, backend, and persistent graph-data configuration together.

JDK 25+ Docker workflow Internet for first build No separate Node required

terminal

# Build backend and frontend
$ ./mvnw clean package

# Start the application
$ java -jar target/dependency-risk-graph-0.0.1-SNAPSHOT.jar

# Or build and run everything with Docker
$ ./run.sh

# Open the application
→ http://localhost:8080

Project license

Licensed under Apache 2.0.

Dependency Risk Graph is free to use, modify, and distribute under the Apache License, Version 2.0, subject to its terms and conditions.

Read the full license

Next steps

Building toward neuro-symbolic security intelligence.

Joining deterministic knowledge-graph reasoning with grounded generative AI.

Dependency paths

Complete and validate deterministic dependency-path discovery and visualization.

In progress

Neuro-symbolic AI

Combine GraphRAG, symbolic dependency reasoning, and inspectable evidence for grounded security answers.