Same context, a different frame of mind. All three modes read the same live data — findings, exploit intelligence, SBOMs, signatures and the PixLog audit trail. They differ in temperament: what they reach for first, how much they show their working, and how far they range from the record.
Three ways to ask Pix
Rubber Duck
A fast, plain-spoken debugging and triage sounding-board. Best when you want to reason through a finding, sanity-check an approach, or get unstuck quickly — Malscan trips on a postinstall mid-pipeline and you talk the taint path out loud before paging anyone.
Kremvax
A meticulous auditability and provenance analyst. Best when you need an evidence trail — which build emitted an artifact, whether the SBOM matches the bytes on disk, and whether the signing key has authored every prior release or first appeared last Tuesday.
Dark Avenger
A deep cross-domain investigator. Best for hard, open-ended questions that connect the audit trail to the wider threat picture — a poisoned package whose hash shifts between runs, the campaign it belongs to, and every repo that pulled it before the firewall caught it.
Grounded in the record, not the vibe
A security assistant that makes things up is worse than none. Every answer Pix gives is anchored to real records — the finding, its enrichment, the SBOM, the signature chain — and every model call is logged to PixLog with model name, tokens and cost. Low-confidence calls route to a human, and every override feeds back so the next answer is sharper.
Free, and open source
Pix in Resolve is one surface. The same scanning engine is a free, Apache-2.0 CLI (CLI docs, github.com/Vulnetix/cli), and the same assistant runs inside your own AI coding agent as an open-source plugin the CLI powers (plugin docs, github.com/Vulnetix/pix-ai-coding-assistant). Role-shaped slash-commands — /vulnetix:soc-triage, /vulnetix:fix, /vulnetix:safe-version, /vulnetix:vex-publish — run the manual coordination loop a triage guide walks by hand: intake, dedup, reproduce, confirm reachability, chase provenance, write the VEX, coordinate the fix. The Code Scanner, Package Firewall and Safe Patching are the free tools Pix reaches for under the hood.
How Pix compares
Most AI in AppSec tools is an autofix box bolted to a SAST scanner — valuable, and narrow. Pix answers three different questions: talk me through it, prove it holds up, and connect it to who is behind it — on free, open tooling. Comparisons drawn from each vendor's published documentation as of July 2026.
Snyk Agent Fix
Agentic autofix for SAST findings from a library of expert-written fixes. Remediation-focused; no signature provenance or threat-actor investigation. Commercial SaaS.
Endor Labs AURI
AI analyst that triages findings true/false-positive on function-level reachability. Strong on reachability; not signing-key lineage or campaign attribution. Commercial SaaS.
Aikido AutoTriage / AutoFix
Cross-scanner noise reduction and autofix pull requests across SAST, SCA, IaC and secrets. No provenance or threat-intel layer. Commercial SaaS.
GitHub Copilot Autofix
CodeQL alerts turned into LLM fix suggestions in the pull request. Fix-focused; part of GitHub Code Security licensing.
Semgrep Assistant
AI triage and fix guidance over Semgrep SAST findings. The scanner is open source; the Assistant is a paid cloud feature.
Pix (Vulnetix)
Conversational, three modes: a triage sounding-board, a provenance analyst (SBOM-vs-bytes, signing-key lineage, PixLog trail) and a cross-domain investigator (campaign, actor and C2 from the Vulnetix VDB). Runs on a free, open-source CLI and open-source coding plugin.
Where to find it
Pix lives where the finding does, inside Resolve triage. The mode switcher sits across the top; Shift+Tab cycles Rubber Duck, Kremvax and Dark Avenger mid-conversation.