🏆 IBM Bob AI Builders Challenge 2026

Security vulnerabilities
fixed while you sleep

VulnSlayer is an autonomous AI agent that takes a Jira vulnerability ticket from scan to merged-ready PR — with zero developer involvement in the fix path.

159+
Tickets Fixed
68+
PRs Raised
318+
Dev Hours Saved
0
Open Criticals
<5 min
Per Ticket
See How It Works Open Source ↗

The Problem

One developer. Stuck on the vulnerability treadmill.

Every enterprise running containerised software pays a hidden tax on developer productivity. Security scanners — Mend SCA, Twist Lock, Prisma Cloud — scan continuously. They raise one Jira ticket per vulnerable package, per component. In a platform with three services and 50+ Java dependencies, a single CVE can generate 10–15 tickets in one scan run.

1
Open ticket — Read CVE description, identify package and version
2
Research fix — Look up CVE in NVD, find minimum safe version (20–30 min)
3
Find the file — Locate the right pom.xml or Dockerfile in the right repo (10–20 min)
4
Apply fix — Edit one version tag, create branch, push commit
5
Raise PR — Write description, add reviewers, add labels
6
Update Jira — Post PR link, transition status, update labels (10 min)

It is not hard work. It is not creative work. It is assembly-line work — identical steps, every time, for every ticket. For hybrid-ipaas, this was consuming one developer's full attention every quarter.


IBM Bob + 4 MCP Servers + 550+ lines of orchestration rules

VulnSlayer is a purpose-built custom mode inside IBM Bob — not a generic chatbot. It has its own role, tool access, safety guardrails, and a deterministic 6-phase workflow.

🤖 IBM Bob IDE VulnSlayer Custom Mode 550+ lines · 6-phase workflow · Safety guardrails atlassian MCP Jira read / write Ticket lifecycle github MCP Files · Branches PRs · Code changes cve-intelligence MCP NVD + GHSA lookup Safe version detection github-extras MCP ⭐ PR Reviewers Assignees · Labels Open sourced on npm Jira Cloud Tickets · Transitions Labels · Comments GitHub API Files · Branches Pull Requests NVD + GHSA CVE Database Safe Versions PR Review APIs Reviewers Assignees · Labels 6-PHASE WORKFLOW Phase 1–2 Discover & Parse Phase 3 CVE Research Phase 3.5 Framework Analysis Phase 4 Apply Fix Phase 5 Raise PR Phase 6 Update Jira

github-extras MCP was built and open-sourced to fill a gap in the official GitHub MCP — PR reviewer/assignee APIs were missing. Available on npm: vidhya03/mcp-github-extras


Use Cases

6 scenarios VulnSlayer handles autonomously

Every use case is grounded in real production tickets from March–July 2026.

Java / Mend SCA

Java Library Vulnerabilities

"CVE found in jackson-databind 2.21.2"
  • Looks up CVEs in NVD → finds minimum safe version
  • Detects Spring Boot framework in pom.xml
  • Applies property override — never touches parent version
  • Raises PR with confidence scores + dual recommendations
7 CVEs · 6 tickets · 1 PR
Docker / Twist Lock

Docker Base Image Updates

"Vulnerable Java runtime in tms-worker"
  • Skips CVE research — always uses latest STIG-hardened image
  • Reads RELEASE.md from internal base-images repo
  • Updates FROM tag in Dockerfile only
  • Twist Lock scan on PR confirms fix automatically
STIG Release 1.64 — tms-worker, service-broker, platform-ui
Multi-Component

Multi-Component Batching

"Same CVE in tms-worker, service-broker, platform-ui"
  • Groups components by GitHub repository
  • Commits all Dockerfiles in a single branch per repo
  • Raises 2 PRs total (not 3)
  • Updates all 3 Jira tickets with relevant PR link
3 tickets → 2 PRs → 1 developer review
Framework-Aware v2.0

Framework Dual Recommendations

"spring-security CVE — Spring Boot manages this"
  • Detects Spring Boot / Jakarta EE / Quarkus parent POM
  • Calculates confidence: Option A (override) vs Option B (SB bump)
  • Always applies Option A — never auto-applies Option B
  • PR shows decision matrix so reviewer can choose strategically
Reviewer gets structured decision, not a code dump
Opensource Path 🆕

Upstream / Third-Party Images

"38 tickets for temporal/admin-tools — we don't own it"
  • Classifies image as upstream-owned (not our code)
  • Consolidates 38 tickets into 3 root-cause clusters
  • Files 2 structured GitHub issues (not 38 — that's spam)
  • Comments all 38 Jira tickets with upstream issue link
  • Closes all 38 as Won't Fix with documented justification
38 tickets → 2 GitHub issues → all closed in one session
Wave Cleanup 🆕

Framework Wave Cleanup PR

"pom.xml has 8 overrides — half are now redundant"
  • After security wave merges, checks latest SB patch release
  • Reads Spring Boot BOM to find which overrides are now native
  • Removes superseded overrides, retains still-needed ones
  • Documents every removal/retention with inline comment
pom.xml stays clean — technical debt never accumulates

Opensource Path — Real Example

38 Jira tickets. 2 GitHub issues. Done.

The temporal/admin-tools image generated 38 Jira tickets (SCI-17720 → SCI-17757) from a single Twistlock scan run. VulnSlayer's Opensource Path handled the entire incident:

ClusterRoot CausePackages / CVEsTicketsGitHub Issue
A tctl binary compiled with Go 1.15.11 (EOL Aug 2021) 25 stdlib packages — net/http, crypto/tls, html/template, crypto/x509 + 21 more 25 #1107 ↗
B Stale Go third-party modules in go.mod jwt-go, grpc, protobuf, yaml.v3, logrus, go-jose, thrift 7 #1107 ↗
C Python 2.7.18 runtime (EOL Jan 2020) bundled in image pip, setuptools, wheel, thrift, click — 40+ CVEs, no patches possible 6 #1108 ↗

"The fix needs to happen upstream. We've reported it clearly and professionally. We've documented why each ticket is closed. We're done — and the upstream project has everything it needs to act."

Dependabot and Renovate have no answer for this scenario — they only handle repositories you control. For enterprise platforms that pull third-party images, VulnSlayer is the only automated path.


Developer Productivity

One developer's week — before and after

This is not theoretical. This is the actual change in how a security-focused developer spends their sprint.

❌ Before VulnSlayer
  • Monday — Triage 15 new CVE tickets
  • Tuesday — Fix + PR for 5 tickets
  • Wednesday — Fix + PR for 5 tickets
  • Thursday — Fix + PR for 5 tickets + Jira updates
  • Friday — Code reviews (finally)
  • Feature work completed: 0
  • CVE time: ~30 hours
✅ After VulnSlayer
  • Monday — Label 15 tickets bob-autofix (10 min). PRs raised by afternoon.
  • Tuesday — Review 15 PRs (~5 min each = 75 min)
  • WednesdayFeature work
  • ThursdayFeature work
  • Friday — Architecture discussions, mentoring
  • Feature work completed: meaningful progress
  • CVE time: ~90 minutes

The human is still essential. They review every PR. They make the merge decision. They own the security posture. They just work one level up.


AI Improving Decision-Making

Not just a fix — a structured recommendation

VulnSlayer v2.0 doesn't just patch the CVE. It explains why the fix was chosen, and surfaces the alternative the team should consider for long-term health.

BEFORE — without framework intelligence

PR: "Bump jackson-databind 2.21.2 → 2.21.5"
Reviewer thinks: Does this conflict with Spring Boot? Should I upgrade SB instead? I don't know, I'll just merge it.

↓ WITH VULNSLAYER v2.0 ↓
Option A — Direct Library Upgrade
Confidence: 65%
Added <jackson-bom.version>2.21.5</jackson-bom.version> property override.
✅ Minimal change · Quick CVE fix · Low risk
⚠️ Overrides Spring Boot managed version · May need revisit when SB is upgraded
Option B — Spring Boot Upgrade
Confidence: 85%
Upgrade Spring Boot 3.5.14 → 3.5.16. SB 3.5.16 ships jackson 2.21.5 natively.
✅ Framework-managed · Cleaner long-term · No override needed
⚠️ Broader scope · Requires more testing in this sprint
Reviewer: "Option B is clearly better long-term. I'll approve Option A for now, and we'll plan the SB bump in the next sprint. I can actually make an informed decision here."

Production Results

March — July 2026. Real tickets. Auditable numbers.

159+
Tickets Processed
68+
PRs Raised
82%
PR Merge Rate
18/18
Critical Resolved
318+
Dev Hours Freed
0
Open Criticals
ReleasePeriodTicketsPRs🔴 CriticalDev hrs saved
11.3.4.0Mar 14–2415125~30 hrs
11.3.5.0Mar 26–Apr 2424184~48 hrs
11.3.6.0May 4–Jun 154209~108 hrs
11.3.7.0May 26–Jun 1838120 ✅~76 hrs
11.3.8.0Jul 202628+60 ✅~56 hrs
TotalMar–Jul 2026159+68+0 open~318+ hrs

11.3.7.0 was the first ever zero-Critical release in the team's history. 11.3.8.0 maintained it. Every ticket maps to a PR, a CVE, and a release — fully auditable.


Comparison

VulnSlayer vs Dependabot vs Renovate

Dependabot and Renovate manage dependencies. VulnSlayer manages security incidents. These are different problems requiring different solutions.

CapabilityVulnSlayer v2.0DependabotRenovate
TriggerJira ticket from security scanScheduled pollScheduled poll
CVE sourceNVD + GHSA + description parsingGitHub Advisory onlyMultiple (basic)
Fix targetMinimum safe versionLatest versionConfigurable
Framework detection✅ Spring Boot, Jakarta EE, Quarkus, Micronaut❌ None⚠️ Limited
Dual recommendations✅ Option A + B with confidence scores❌ Single path❌ Single path
Jira integration✅ Bidirectional — reads + writes❌ None⚠️ Configurable
STIG-hardened images✅ Native — reads internal STIG catalog❌ No❌ No
Multi-component batching✅ Groups by repo, optimises PRs❌ One PR per package⚠️ Can group
Upstream/OSS path✅ Files upstream issues, closes tickets❌ Can't handle❌ Can't handle
Wave cleanup PR✅ Auto-removes superseded overrides❌ No❌ No
FedRAMP / STIG compliance✅ Designed for regulated environments❌ No❌ No
Failure handling✅ Comments on Jira, marks manual-review❌ Silently skips⚠️ Email alerts
Open source contribution✅ mcp-github-extras on npmGitHub-proprietary✅ Open source

The Moment It Clicked

On a Friday afternoon in March 2026, 17 vulnerability tickets landed.

Normally that meant a developer starting Monday with a full week of tedious patch work. Instead, someone added the bob-autofix label to each ticket.

By Monday morning, 17 PRs were waiting for review. Each one had the CVE research done, the fix applied, the reviewers assigned, and the Jira ticket updated.

The developer spent 90 minutes reviewing the PRs. All 17 merged by noon.

The afternoon was free.

mcp-github-extras on npm ↗ View on GitHub ↗