{"id":51941070,"url":"https://github.com/capitalone/VulnHunter","last_synced_at":"2026-08-03T05:00:54.741Z","repository":{"id":372798367,"uuid":"1292756053","full_name":"capitalone/VulnHunter","owner":"capitalone","description":"Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.","archived":false,"fork":false,"pushed_at":"2026-07-23T12:05:58.000Z","size":851,"stargazers_count":670,"open_issues_count":7,"forks_count":89,"subscribers_count":6,"default_branch":"main","last_synced_at":"2026-07-23T14:06:33.121Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/capitalone.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-07T20:24:50.000Z","updated_at":"2026-07-23T13:25:37.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/capitalone/VulnHunter","commit_stats":null,"previous_names":["capitalone/vulnhunter"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/capitalone/VulnHunter","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capitalone%2FVulnHunter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capitalone%2FVulnHunter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capitalone%2FVulnHunter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capitalone%2FVulnHunter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/capitalone","download_url":"https://codeload.github.com/capitalone/VulnHunter/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/capitalone%2FVulnHunter/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36218648,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-08-03T02:00:06.975Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-28T19:00:29.480Z","updated_at":"2026-08-03T05:00:54.736Z","avatar_url":"https://github.com/capitalone.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# VulnHunter\n\n\u003e **From pattern-matching to provability.**\n\nVulnHunter is an open-source, **agentic AI security tool** that applies proactive, attacker-first analysis directly to source code. \n\nUnlike traditional, passive SAST scanners that flag suspicious patterns and often cause false positives, VulnHunter reasons like an adversary. It **identifies** which defects are actually exploitable, maps prospective attack paths, and proposes targeted, evidence-backed fixes.\n\nModern software supply chains are deeply interconnected. A single vulnerability in a widely-used open-source component can ripple across thousands of enterprises simultaneously.\n\nDeveloped internally at Capital One, VulnHunter is released to the community because no single organization can solve this challenge alone.\n\n----\n\n\u003e [!WARNING]\n\u003e **Cyber-safeguard disclaimer**\n\u003e VulnHunter performs dual-use cybersecurity work (vulnerability discovery and exploitation). If you run it against an Anthropic account that is **not** enrolled in Anthropic's [Cyber Verification Program](https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude), real-time cyber safeguards may block requests and your usage may be flagged for cyber abuse. If you intend to use VulnHunter on Anthropic's first-party platforms (Claude API / Claude Code), we strongly recommend enrolling first via the [verification portal](https://portal.anthropic.com/programs/cvp).\n\n---\n\n\u003e [!IMPORTANT]\n\u003e **Prerequisites \u0026 Model Requirements**\n\u003e Built and optimized for **Claude Opus** running in **[Claude Code](https://docs.claude.com/en/docs/claude-code)**. \n\u003e The framework depends on deep, multi-step reasoning and requires frontier Opus-class models. **You supply your own model access.**\n\n---\n\n## Why VulnHunter is Different\n\n* **Attacker-First Forward Analysis:** Conventional tools often leverage \"sink-first\" analysis, looking at potentially dangerous code patterns to search backward for a hypothetical attacker, flooding teams with false positives. VulnHunter flips this model to simulate a bad actor's exact journey. It begins at potential attacker-accessible entry points (APIs, network messages, file uploads) and reasons *forward* to evaluate whether an attacker can truly break through.\n* **Falsification Engine:** After finding a potential vulnerability, VulnHunter runs a structured reasoning workflow specifically designed to *disprove* its own argument. It searches for flawed assumptions, logic gaps, or security controls that would block the attack. It is designed to immediately discard findings that rely on unsupported assumptions. What reaches you is a high-priority, actionable defect.\n* **Evidence-Backed Remediation:** When a defect survives the falsification engine, VulnHunter maps the exact exploit path, explains the structural flaw, details the specific capabilities or access an attacker would gain, and generates focused, targeted code changes for review.\n\n---\n\n## The Closed Loop: Hunt → Fix → Verify\n\nVulnHunter ships as three composable [Claude Code](https://docs.claude.com/en/docs/claude-code) skills that form a complete, automated remediation loop:\n\n| Skill | Phase | Core Responsibility |\n| :--- | :--- | :--- |\n| **`/vulnhunt`** | **Hunt** | Maps entry points to dangerous sinks. Filters findings through a multi-stage falsification pipeline (Recon → Parallel Hunt → Adversarial Disprove → Capability Filter). Emits only verified issues with an executable exploit and a proposed fix. |\n| **`/vulnhunter-fix`** | **Fix** | Developer-led, test-driven remediation. It writes an exploit demo, creates a failing security test (**RED**), implements the code fix (**GREEN**), verifies the exploit is blocked without regressions, and cuts a reviewable PR. |\n| **`/vulnhunt-fix-verify`** | **Verify** | A completely separate, read-only agent that independently validates whether a finding was successfully remediated. It emits a per-finding verdict so fixes are proven, not taken on faith. |\n\n\u003e **Note:** For running this loop unattended at scale, `vulnhunter-agent/` wraps the scanner in a headless runtime, while `harness/` drives it across multiple repositories in batch.\n\n\u003e **On the naming:** the suite is **VulnHunter**, but the core scanner command is `/vulnhunt` (and the verifier `/vulnhunt-fix-verify`) — the shorter form is intentional, not a typo. The `/vulnhunter-fix` remediation skill and the `vulnhunter-agent/` runtime keep the full spelling.\n\n---\n\n## Repository Layout\n\nEach component is organized into a self-contained subtree:\n\n| Path | Description |\n| :--- | :--- |\n| `vulnhunt/` | The core `/vulnhunt` scanner skill (Prompt-only: `SKILL.md` + phases). See [`vulnhunt/README.md`](vulnhunt/README.md). |\n| `vulnhunter-fix/` | The `/vulnhunter-fix` skill, its companion Python helper package, and tests. See [`vulnhunter-fix/README.md`](vulnhunter-fix/README.md). |\n| `vulnhunt-fix-verify/` | The `/vulnhunt-fix-verify` standalone verification skill (Prompt-only). See [`vulnhunt-fix-verify/README.md`](vulnhunt-fix-verify/README.md). |\n| `vulnhunter-agent/` | Config-driven headless runtime wrapper that runs scans and files GitHub issues. See [`vulnhunter-agent/README.md`](vulnhunter-agent/README.md). |\n| `harness/` | Developer tooling for running large batch-scans and benchmarking detection accuracy. See [`harness/README.md`](harness/README.md). |\n\n---\n\n## Requirements \u0026 Setup\n\n### Prerequisites\n* [Claude Code CLI](https://docs.claude.com/en/docs/claude-code), authenticated with access to **Claude Opus**.\n* Python 3.12+ (Required only for the runtime agent and the benchmarking harness).\n* *Responsibility Check:* Ensure you are only scanning code bases you are explicitly authorized to analyze.\n\n### Installation\n\n```bash\n# Clone the repository\ngit clone https://github.com/capitalone/vulnhunter.git\ncd vulnhunter\n\n# Copy skills into ~/.claude/skills/\n./install.sh      \n\n# (Optional) To clean up or remove installed skills\n# ./uninstall.sh    \n```\n\nOn Windows, use the `.cmd` equivalents from a `cmd.exe` or PowerShell prompt:\n\n```bat\ngit clone https://github.com/capitalone/vulnhunter.git\ncd vulnhunter\n\nREM Copy skills into %USERPROFILE%\\.claude\\skills\\\n.\\install.cmd\n\nREM (Optional) To clean up or remove installed skills\nREM .\\uninstall.cmd\n```\n\n\u003e [!NOTE]\n\u003e `install.sh`/`install.cmd` copy files directly (rather than symlinking) because symlinks can break `find`/`glob` functionality inside subagents. Re-run the install script after pulling updates to refresh your local environment.\n\n---\n\n## Usage Guide\n\n### 1. Run the Scanner\n```bash\nclaude --model opus --add-dir ~/.claude/skills/vulnhunt --add-dir ~/.claude/skills/vulnhunt/phases\n\n# Inside the Claude Code session, invoke:\n/vulnhunt\n```\n\n### 2. Run the Fixer\nThe fixer requires `git`, the GitHub CLI (`gh`) authenticated to your target repositories, and its Python helpers installed (`pip install -e \".[dev]\"` inside the `vulnhunter-fix/` directory).\n\n```bash\nclaude --model opus --add-dir ~/.claude/skills/vulnhunter-fix\n\n# Inside the Claude Code session, invoke:\n/vulnhunter-fix\n```\n*See [`vulnhunter-fix/README.md`](vulnhunter-fix/README.md) for advanced operational modes and configuration settings.*\n\n### 3. Run the Fix Verifier\nThe verifier runs strictly read-only over trusted roots under a tight tool envelope (Read/Write/Edit/Glob/Grep/Agent—**no Bash execution, no network access**). The caller must pre-create the output (`out`) directory.\n\n```bash\nclaude --model opus --add-dir ~/.claude/skills/vulnhunt-fix-verify \\\n       --add-dir ~/.claude/skills/vulnhunt-fix-verify/phases\n\n# Inside the Claude Code session, invoke:\n/vulnhunt-fix-verify repo=\u003cabs_path\u003e report=\u003cabs_path\u003e fixed=VULN-001,... out=\u003cabs_path\u003e [comments=\u003cabs_path\u003e] [additional_repos=\u003cpath1\u003e,\u003cpath2\u003e]\n```\n\n---\n\n## Automation \u0026 Scale\n\n### Headless Runtime Agent (`vulnhunter-agent/`)\nFor non-interactive or CI/CD pipelines, `vulnhunter-agent/` wraps the scanner into a headless workflow. It clones targets, executes `/vulnhunt`, publishes results, and opens GitHub issues for confirmed bugs. It connects natively via the direct Anthropic API. \n\nReview the [`vulnhunter-agent/README.md`](vulnhunter-agent/README.md) for deployment blueprints.\n\n### Local Harness (`harness/`)\nThe `harness/` directory provides workstation-scale developer tooling. To initialize, run `cd harness \u0026\u0026 pip install -e \".[dev]\"`.\n\n#### Batch Scanning\nManage your target list in `harness/local_harness/batch/REPO_LIST.txt` (one GitHub URL per line, lines starting with `#` are ignored):\n\n```bash\ncd harness\npython -m local_harness.batch.run scan                  # Clone and scan every repo in the list\npython -m local_harness.batch.run scan --resume         # Skip repositories already processed\npython -m local_harness.batch.run status                # Monitor progress across your batch\npython -m local_harness.batch.run collect               # Gather all findings for centralized review\n```\n\n#### Benchmarking Mode\nEvaluate scanner accuracy against a known-vulnerable vulnerability corpus (Clone → Scan → LLM-Judge → Tally Metrics):\n\n```bash\npython -m local_harness.benchmark.run                  # Execute full benchmark run\npython -m local_harness.benchmark.run --repos \"name\"   # Benchmark a single target repository\npython -m local_harness.benchmark.run --tally-only      # Re-generate the analytical report only\n```\n\n\u003e **Bring Your Own Corpus:** This repository ships with a minimal synthetic example (`harness/local_harness/benchmark/ground_truth/EXAMPLE.json`) mapped to public targets like OWASP NodeGoat, Juice Shop, and WebGoat. Build out your own testing suites inside `ground_truth/\u003crepo\u003e.json`. Define your target scanning/judging engines in `harness/local_harness/config.py`.\n\n---\n\n## Running Tests\n\nEach Python component maintains its own isolated testing suite. Run them using `pytest`:\n\n```bash\ncd harness          \u0026\u0026 pip install -e \".[dev]\" \u0026\u0026 python -m pytest tests/ --cov=local_harness\ncd vulnhunter-fix   \u0026\u0026 pip install -e \".[dev]\" \u0026\u0026 python -m pytest -q\ncd vulnhunter-agent \u0026\u0026 pip install -e \".[dev]\" \u0026\u0026 python -m pytest -q\n```\n\n---\n\n## Contributing, Security \u0026 License\n\n* **A Note on Models:** VulnHunter was precision-tuned for **Claude Opus** and **Claude Code**. Its low false-positive discipline relies heavily on frontier-class reasoning, though the underlying orchestration patterns can be adapted to other advanced foundation models.\n* **Contributing:** See [CONTRIBUTING.md](CONTRIBUTING.md) to propose core framework improvements, prompt updates, or wider model support configurations.\n* **Security:** Review [SECURITY.md](SECURITY.md) for instructions on how to safely report security vulnerabilities found within VulnHunter itself.\n* **License:** Distributed under the terms of the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcapitalone%2FVulnHunter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcapitalone%2FVulnHunter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcapitalone%2FVulnHunter/lists"}