quack-patch

--detect.llm.api.endpoint

Specifies the base URL of the LLM Gateway that the Quack Patch tool will send requests to.

--detect.llm.api.key

Provides the API key used to authenticate with the configured LLM Gateway.

--detect.llm.name

Defines which LLM model Quack Patch should use when performing analysis.

Quack Patch has been verified with the following model names: Claude Sonnet 4, GPT-4 and Gemini 2.5 Pro. You may use other OpenAI API standard compatible models supported by your LLM Gateway.

--detect.quack.patch.enabled=false

If set to true, Detect will invoke Quack Patch -- a tool that uses LLMs to generate code patches for vulnerable transitive components.

Only supported for Rapid and Stateless Scan modes. detect.llm.api.key, detect.llm.api.endpoint, and detect.llm.name must also be set. See Quack Patch for further details.

--detect.quack.patch.output.path

Specifies the output directory for Quack Patch results.

If not set, the Quack Patch results are placed in a 'quack-patch' subdirectory under scan output directory.