Optimize software supply chain remediation portfolio

What it's for

Moves software supply-chain management from ranked CVEs to a board-ready patch/upgrade/replace/isolate/accept portfolio that prices business loss, delivery disruption, compliance and tail risk without double-counting dependency paths.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

{
  "applications": [
    {
      "evidence_verified": true,
      "id": "checkout",
      "value_at_risk": 200
    },
    {
      "evidence_verified": true,
      "id": "admin",
      "value_at_risk": 80
    }
  ],
  "budget": 25,
  "capacity_units": 2,
  "components": [
    {
      "direct_loss_if_incident_scenarios": [
        10,
        20
      ],
      "evidence_verified": true,
      "id": "parser",
      "incident_probability_scenarios": [
        0.1,
        0.4
      ]
    },
    {
      "direct_loss_if_incident_scenarios": [
        20,
        40
      ],
      "evidence_verified": true,
      "id": "runtime",
      "incident_probability_scenarios": [
        0.05,
        0.2
      ]
    }
  ],
  "exposure_edges": [
    {
      "application_id": "checkout",

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

{
  "assumptions": [
    "Each governed component receives exactly one executable accept, patch, upgrade, replace, isolate or remove option. Base incident probabilities, direct loss, application value, option effects, compatibility, availability and costs share one point-in-time scenario perimeter.",
    "Overlapping dependency paths combine through multiplicative survival inside each unique application, so its value is never repeated per package or path. Direct incident cost, application disruption, transition, operating and upfront cost are complete and non-overlapping.",
    "Exact mode certifies only the supplied finite model. Beam mode uses an optimistic cost bound and is not globally optimal; neither mode proves exploitability, causal remediation effects, compatibility, license interpretation or authority to change production.",
    "Outputs are aggregate portfolio decision support, never maintainer, vendor or worker risk scores and never automatic authority to patch, isolate, remove, disclose, investigate, procure or terminate a relationship."
  ],
  "component_diagnostics": [
    {
      "component_id": "parser",
      "current_option_id": "parser-accept",
      "option_count": 2,
      "selected_action": "upgrade",
      "selected_option_id": "parser-upgrade"
    },
    {
      "component_id": "runtime",
      "current_option_id": "runtime-accept",
      "option_count": 2,
      "selected_action": "isolate",
      "selected_option_id": "runtime-isolate"
    }
  ],
  "constraints": {
    "budget": 25,
    "capacity_units": 2,
    "maximum_cvar_total_loss": null,
    "maximum_expected_total_loss": null,
    "maximum_option_unavailability_probability": 0,
    "require_license_compliance": true,
    "risk_aversion": 0,
    "tail_probability": 0.1
  },
  "decision": "software_supply_chain_remediation_portfolio_supported",
  "method": "unique_application_supply_chain_multiple_choice_cvar_portfolio_v1",
  "remediation_pareto_frontier": [
    {
      "cvar_total_cost_and_loss": 104.32,
      "expected_total_cost_and_loss": 41.28,
      "risk_feasible": true,
      "selected_option_ids": [
        "parser-accept",
        "runtime-accept"
      ],

How it works

Constrained optimization — Pick the best feasible option under real limits — budget, headcount, dependencies, capacity — rather than ranking a list and hoping it fits.

1. 1 Freeze unique application values, component-by-scenario incident probabilities and direct losses, exposure fractions, executable option effects/costs/availability, compatibility relations and current-state options.
2. 2 For every complete policy, combine overlapping component paths through multiplicative survival inside each application, add non-overlapping direct/transition/operating/upfront costs, and enforce license, availability, dependency, exclusion, budget and capacity feasibility.
3. 3 Apply expected-loss and CVaR gates, return the cost-loss-tail Pareto frontier, compare with the current policy, and disclose exact global certification or deterministic optimistic-cost beam search.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Calibrating it to your org

Calibration workflow

1. 1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2. 2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3. 3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4. 4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5. 5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6. 6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "choose exactly one accept patch upgrade" }
  → finds "optimize_software_supply_chain_remediation_portfolio"

gitrevio_capability_describe
  { "capability_id": "optimize_software_supply_chain_remediation_portfolio" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "optimize_software_supply_chain_remediation_portfolio", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

See every tool in Security, access & compliance →