Xpsd v1.0.0 - First public release.

Xpsd decides whether a reported vulnerability is actually reachable in your source tree, so you can triage a scan by what matters rather than by CVSS alone.

Using it

• GitHub Action: byteray-ai/xpsd@v1. Container image: ghcr.io/byteray-ai/xpsd:1.0.0.
• Runs on GitHub Copilot through the workflow's built-in GITHUB_TOKEN, so no separate LLM key is needed. Bring-your-own-key works too, for OpenAI compatible, Anthropic, or Azure.
• Reads Grype, Trivy, OSV-Scanner, Snyk, or any SARIF 2.1.0 report, auto-detected.
• Writes SARIF for the Security tab, plus per-finding verdict JSON and optional markdown reports.