Security tooling you can use for free and read line by line.

• 160 named vulnerability sources
• 50 VDB queries a day, and the CLI needs no key
• 31 MCP tools for any AI coding agent
• $0 with no card and no sales call

Live right now, with no account needed: KEV Watch, Bug Bounty Intelligence, the Red Hat archive, the intelligence sources and the Rules Registry.

Per-seat pricing, three-year contracts, and the blame lands on you. Not with Vulnetix, not even on the Community tier.

Most security vendors charge per seat, ask for multi-year enterprise contracts, and cover little more than the CVE Program and NVD, whose enrichment has fallen behind since February 2024. When a detection is wrong or a fix they handed you does not land, the support ticket comes back saying you configured it badly.

Never accept exorbitant prices or user blame again. The Community tier shows what good looks like, and any vendor still charging per seat for CVE-only coverage will have to explain why.

Read why CVE and NVD coverage alone falls short

The tools that touch your code are open source.

The scanner, the coding harness and the agent plugin are published under OSI-approved licences. You can fork them, audit them and run them without a Vulnetix account.

• Vulnetix CLI (AGPL-3.0): SCA, SAST, secrets, IaC, containers, licences, malware, SBOM, VEX, CBOM and AI-BOM in one binary. Every SAST rule is Rego you can open.
• Belai (Apache-2.0): a coding harness that seals its context, ships a classifier inside the binary and sends no telemetry. Agents and crews run on your own machines.
• Pix skills, agents and hooks (Apache-2.0): 18 skills, 5 subagents and 3 guard hooks for Claude Code, Codex, Cursor, Copilot, Gemini CLI and five more agents.
• Rego rule packs (Apache-2.0): Trivy, KICS, Regula, gosec, Ruff and more, ported to Rego and loaded straight from Git with one flag.
• SSVC for Python and TypeScript (MIT): the decision logic behind our triage, as libraries you can put in your own tooling.
• Homebrew and Scoop (AGPL-3.0): install channels for macOS, Linux and Windows, with every formula and manifest public.

The OSI logo marks licences approved by the Open Source Initiative. It is a trademark of the Open Source Initiative.

Every record links to where it came from, including the ones we write.

We reconcile 160 named upstream sources and keep the upstream ID on every record. When Vulnetix finds a vulnerability nobody has published, we issue it as GCVE GNA 110 and commit it to a public GitHub repository, so you can clone the original source of our own records too.

160 sources, all named

The full list is public, and every record keeps its upstream identifiers so you can check our work against the original. See the sources

New records go to GitHub

As GCVE GNA 110 we publish in CVE JSON 5, OSV and Vulnetix formats under CC-BY-4.0. You can clone, mirror and cite the repository. Open the repository

Specs written in public

CRIT, our format for cloud vulnerability records, is an IETF draft. We donated our Transparency Exchange server to OWASP. Read the CRIT draft

Your source code stays on your machine.

Scanning runs locally. The only thing that crosses the network is a package name and version or an identifier, and you decide whether that leaves too.

• CLI and IDE: every scanner runs locally. The VS Code extension uses the same engine, so source never leaves the machine.
• Browser: the extension finds identifiers inside the page. It sends no page content, URLs or telemetry.
• Agents: Belai sends no telemetry, and its classifier runs in the binary with no API key. A local decision model can answer every judgement offline.
• AI keys: provider keys are stored KMS-encrypted in a vault you control, and the AI Firewall gateway does not store your prompts.
• Air gap: Enterprise runs on your premises or fully air-gapped.

Leave whenever you like, with all of your data.

Every export is an open standard that the tools you already run can read. Moving to another product means pointing it at the same files.

• CycloneDX 1.7: SBOM, CBOM and AI-BOM
• SPDX 2.3: SBOMs with resolved licences
• SARIF: findings from any scanner
• OpenVEX and CSAF: exploitability statements
• STIX 2.1: free malware threat feeds
• CVE JSON 5 and OSV: the advisories we publish
• TEA 1.0: transparency exchange, readable without an account
• in-toto and Sigstore: signed attestations you can verify

Twelve vendor archives, ranked the way you choose.

Every month of every vendor's advisories with EPSS, KEV and proof-of-concept data, an end-of-life calendar, and four ways to order the list: Vulnetix priority, vendor rating, CVSS or EPSS. Browse the archives

What the Community tier includes

• Code scanner: SCA across 36 ecosystems, 790+ SAST rules, 1,000+ secret rules, IaC, containers, licences and malware.
• Vulnerability database API: 160 sources, fixes, KEV, EPSS, exploit counts and trends. Responses keep the same shape when you upgrade.
• MCP server: 31 tools and 18 workflows for twelve MCP clients, connected with one URL and one header.
• Agent skills and hooks: a dependency guard at the tool call in ten coding agents, from one install command.
• Belai, agents and crews: the coding harness with 30 built-in agents and 5 crews, and always-on agents on your own hardware.
• Package Firewall for Go and Arch: malware, KEV and policy blocking at install time for Go, pkg.go.dev, Arch and AUR.
• AI Firewall gateway: 13 LLM providers behind one gateway, with BYOK keys in a vault and an inventory of the MCP servers your agents use.
• Research Lab: twelve vendor patching archives with EPSS, KEV, EOL and a prioritisation you can switch, plus Vulnetix KEV.
• Malware STIX feeds: per-ecosystem STIX 2.1 indicators every 15 minutes, with guides for twelve SIEM, SOAR and edge tools.
• The console: every page opens on a free account, including findings, risk prioritization, quality gates, Release Jails and inventories.
• 30 CI/CD platforms: results from 132 open source scanners land in the same queue.
• Editor and browser: the VS Code extension in 13 editors, and the browser extension for Chrome and Firefox.

Start on the free tier and stay as long as you like.

Paid plans add enrichment, defence rules and more keys to the same responses you already use.