The vulnerability brain for your AI coding assistant
Pix runs inside the AI coding agent your developers already use: Claude Code, Cursor, Codex, Gemini, Copilot, Amazon Q, and nine more. It probes your toolchain on session start, filters every API response to fit your LLM's context window, and routes your natural-language prompts to the matching workflow. Vulnerability intelligence becomes a side-conversation in the editor instead of a dashboard you forget to check.
One command. Distributed via three Claude Code plugin marketplaces; works with 41+ agents that support SKILLS.md.
npx skills add Vulnetix/pix-ai-coding-assistant
Find Pix on buildwithclaude.com, agentskill.sh, and skillsmp.com. 33 skills · 14 hooks · 7 multi-step agents · 59 raw VDB commands · Apache-2.0. Every artefact is a markdown file you can read, fork, or override. Read the docs →
Security that adapts to your role, not the other way around
Most tools give every user the same toolbox and expect them to learn it. Pix exposes three role-shaped tracks; the LLM picks the right one from your natural prompt.
SOC analyst / IR: "What's on fire today?"
The active-exploit queue intersected with the deps you actually ship, not a CVE firehose. STIX export, ATT&CK chains, and KEV deadlines surface only the work that needs you now.
/vulnetix:soc-triage /vulnetix:kev-watch /vulnetix:ioc-pivot /vulnetix:detection-rules /vulnetix:incident-respond /vulnetix:threat-feed
Security engineer: "Resolve the queue."
Triage decisions, repo-impact analysis, rollback-safe fixes, and VEX attestations in one thread, without leaving the assistant or the diff you're reviewing.
/vulnetix:vuln /vulnetix:exploits /vulnetix:fix /vulnetix:remediation /vulnetix:verify-fix /vulnetix:vex-publish
Developer (shift-left): "Ship without regressing."
npm install and git push learn what you're about to ship before you ship it, and stay quiet when it's clean. Per-package cooldowns mean no spam after the first warning.
/vulnetix:dep-add-guard /vulnetix:sast-scan /vulnetix:secret-scan /vulnetix:container-scan /vulnetix:secure-code-write /vulnetix:safe-version
…and 14 more skills + 4 more agents across compliance, SBOM, IaC, license, and supply-chain. Full skill index →
Other tools assume your stack. Pix probes it.
It runs command -v before recommending
Pix's session-start probe writes .vulnetix/capabilities.yaml, a map of 41 binaries and 30 repo signals. Subsequent skills consult it: no Snort binary, no Snort output. Trivy installed, container-scan composes with Trivy.
It filters the API response before the LLM sees it
A single vdb vuln CVE-2021-44228 call returns 4 MB; vdb exploits returns 12 MB. Pix routes every call through a verified jq filter: 94-99% reduction, with SSVC decisions, ATT&CK chains, KEV directives, and recommendedVersions preserved.
It listens to your prompt, not just slash-commands
"I want to triage these vulns" routes to /vulnetix:soc-triage via the prompt-router. Skills declare triggers: in frontmatter; the router matches once per session, never twice.
Security context, surfaced silently
Other plugins warn on every prompt. Pix's 14 hooks fire at most once per session, key on the specific package or file, and stay silent on clean repos, covering session start, git commit, dependency installs, Docker/Containerfile builds, Terraform/OpenTofu apply, git push, manifest and IaC edits, post-install CycloneDX v1.7 SBOM generation, the prompt router, CVE/GHSA context injection, and an end-of-session P1/P2 reminder.
Some security jobs need more than one prompt
Bulk Triage
Parallel CWSS scoring across many vulns. Each analysed independently; a single consolidated memory write at the end prevents race conditions. Output grouped by P1-P4 priority.
Incident Responder
SOC playbook for a CVE actively in the wild. Sightings + IOCs + ATT&CK technique chain + patch path + VEX attestation in one conversation, with parallel VDB pulls.
PR Security Reviewer
SAST + SCA + secrets + container + IaC + license review against the diff in a single pass. Optionally posts the review back to the PR via gh pr review.
No code leaves your machine. Only dependency names and versions are sent to the Vulnetix VDB API. PoCs are cached locally and analysed statically, never executed. The jq filter library cuts payload tokens further: most VDB responses are filtered locally before the LLM ever sees them.
Vulnetix Resolve · Platform IntelligenceEvery decision, informed
The AppSec operations platform: six AI features embedded at every stage of triage, classification, assessment, and response. Separate from the Pix AI Coding Assistant plugin above, which your developers run in their editor.
Smart Queue
Logistic regression and clustering rank findings by CVSS severity, exploit maturity (EPSS, CESS, active exploits, ransomware campaigns), and business context like crown-jewel repositories and policy violations. Each finding carries action hints: first-to-triage flags, missing-severity alerts, active-campaign warnings, and suppression conflicts.
Logistic RegressionClusteringEPSSCrown Jewels
Pix AI Assistant (in Resolve)
The AI chatbot inside the Vulnetix Resolve dashboard, distinct from the Pix AI Coding Assistant plugin, which runs in your developer's editor. Embedding cosine similarity scores each chunk for relevance. Optimized context mode cuts token usage 50-80%. Per-organisation budgets and rolling-window limits keep costs predictable.
Contextual ChatSemantic EmbeddingsPer-Org Budgeting
Reachability Analysis
LLMs identify the exact functions and methods a CVE affects. SCA reachability and SAST source-to-sink analysis check whether those paths exist in your application. Tree-shaking and selective imports mean most builds never include the vulnerable code.
SCA ReachabilitySource-to-SinkTree-Shaking
CWE Assignment
A classification LLM maps findings to CWE identifiers and generates CVSS v4.0 vectors adjusted by contextual keywords. Low-confidence results route to human reviewers who accept, reject, or edit. Every decision hits the PixLog audit trail and feeds back into model evaluation.
CWE-to-CVSS v4.0Reinforcement LoopAudit Trail
Impact Assessments
The Threat Exposure Score pipeline aggregates 20+ enrichment sources: CVE.org, OSV, NVD, EPSS, CESS, CISA KEV, CrowdSec live sightings, Shadowserver, GitHub Advisory, EUVD, ExploitDB, Metasploit, Nuclei, VulnCheck XDB, and more. SSVC maps findings to stakeholder-specific decision outcomes.
20+ SourcesSSVCModel EvalCrowdSec
Operational Security Output
CWSS priority scoring with code-aware reachability feeds actionable outputs. Auto-generated OpenVEX attestations document triage decisions for supply-chain consumers. Internal VDR lets teams share proven remediations. Snort/Suricata-compatible rule generation produces IDS/IPS signatures from exploit intelligence.
CWSSOpenVEXVDRSnort/Suricata
Transparent. Auditable. Human-in-the-loop.
AI should augment security teams, not replace their judgment. Every model decision is logged, reviewable, and reversible.
Model Transparency
Every inference logged with model name, token counts, and cost. Admin-configurable model choice. No black boxes.
Human Oversight
Low-confidence results routed to reviewers. Accept, reject, or edit every classification. Full audit trail via PixLog.
Domain Optimized
Model-eval suites benchmark candidates on security-specific tasks. The best model wins, not the biggest.
The same intelligence, now enforced at the registry
The CVSS, EPSS, KEV, malware and exploit-maturity signals your AI agents reason over now block bad packages across 24 registries and the pkg.go.dev API, before they ever reach a build. One proxy, one policy, free for Go.
Explore Package Firewall → · See pricing
See AI in action
Book a walkthrough to see how AI accelerates vulnerability triage, prioritization, and remediation.