AutoSecAudit: An Extensible Multi-Scanner Orchestration Framework with AI-Assisted Remediation Guidance, Precision Fuzzing, and Delta Auditing in DevSecOps

Abstract: Automating security verification in fast-paced continuous integration and continuous deployment (CI/CD) pipelines creates operational friction: studies of developer tool adoption report that noisy output and missing actionable guidance discourage the use of automated analysis tools [13]. This paper presents AutoSecAudit, an open, extensible dynamic application security testing (DAST) orchestration framework with remediation guidance, designed for CI/CD pipelines and AI developer tooling. It combines (1) attack-surface discovery through a depth-limited recursive crawler, JavaScript route extraction, OpenAPI import, and a scope guard that checks every resolved address; (2) concurrent execution of 19 scanner plugins with heuristic false-positive reduction (baseline-response comparison, a two-phase statistical timing check, single-page-application filtering, and adaptive politeness with retry on HTTP 429/503); (3) an intelligence layer that merges duplicate findings on a canonical key, enriches CVE-tagged findings with CVSS data, maps findings to OWASP Top 10 (2021), CWE, and PCI DSS v4.0 by keyword rules, and assigns plain-English business- risk categories and a five-level posture grade; and (4) delivery features: predefined multi-framework fix recipes, fingerprint-based delta comparison between scans, severity gating through exit codes, and a Model Context Protocol (MCP) server with four tools for AI coding assistants. Applying patches is left to the assistant or developer, and closed- loop remediation is not evaluated. We evaluate the tool on two purpose-built test applications with 17 and 8 planted vulnerabilities, using 5 repetitions per setting on one Windows machine. Testbed 2 was fully detected with no false positive in all 5 runs, whereas testbed 1 was fully detected in 3 of 5 runs (mean recall 81%) because some scans reached the 300 s scan deadline. None of these measured runs reported a false positive, but one further testbed 2 run inside the test suite did (a missing-SameSite cookie finding that matched no planted item). Merging reduced raw plugin alerts by 21% and 22% on complete scans. Increasing worker threads from 1 to 16 did not shorten scans (median 53 s at k=1 and 53 s at k=16), so an earlier speedup claim is withdrawn, and 10 of 25 scans ran longer than the 56 s floor. Delta comparison was exact on two complete scans but produced spurious changes when scans were incomplete. These results come from one machine and small applications written alongside the tool; they say nothing about performance on production applications.

Keywords: Vulnerability Assessment, DevSecOps, Scanner Orchestration, Model Context Protocol (MCP), AI-Assisted Remediation, Statistical Timing Verification, Compliance Mapping, Delta Auditing, Web Security, API Security.