- 25 public repositories
- 3,861 Rego rules in the registry
- GNA 110 GCVE numbering authority
- OSI-approved licences
Three projects that carry the platform
Code Scanner CLI (AGPL-3.0)
One AGPL-3.0 binary covering SCA, SAST, secrets, IaC, containers and licences. It proves reachability with tree-sitter call graphs, runs malscan over your installed dependency bytes, enforces quality gates, detects suppression drift, imports Dependabot alerts, scans compiled binaries, and emits an AI-BOM and a post-quantum CBOM. Drop it into a pre-commit hook or a CI step. Vulnetix/cli
Belai (Apache-2.0)
A safer LLM coding harness. Sealed delimiters with a nonce and SHA-256 hash, a security classifier on every untrusted tool result, and fail-closed posture gates, built into the harness. Agents, crews and a shared kanban run on your own machines with no telemetry. Vulnetix/belai
Pix AI Coding Skill (Apache-2.0)
Adds VDB lookups and remediation hints to Claude Code, Cursor, Windsurf, Codex, Gemini CLI and anything else that reads SKILLS.md. Eighteen skills, five subagents and three guard hooks, installed into ten coding agents with one command. Vulnetix/pix-ai-coding-assistant
curl -fsSL https://cli.vulnetix.com/install.sh | sh vulnetix scan --severity high --block-malware --exploits active
Scanner docs · Code scanner · belai.vulnetix.com · ai-docs.vulnetix.com
We write the specifications we depend on
- IETF CRIT spec (IETF draft): Cloud Resource Identifier Templates, an active IETF draft (draft-vulnetix-crit-02) for telling tools which AWS, Azure, GCP, Cloudflare or Oracle resources a CVE actually affects. Parameterised over ARNs and Resource IDs, with fix-propagation and exposure-window metadata.
- GCVE advisory database (CC-BY-4.0): Every vulnerability Vulnetix finds is issued as GCVE GNA 110 and committed here first, in CVE JSON 5, OSV and Vulnetix formats, so the original source of our own records is something you can clone.
- Transparency Exchange API (OWASP, CycloneDX): The TEA 1.0 server Vulnetix built and donated to OWASP. It answers discovery from a product identifier and passes 213 of 213 conformance cases.
- Python SSVC SDK (MIT): Stakeholder-Specific Vulnerability Categorization in Python. Drop-in scoring with no service call.
- TypeScript SSVC SDK (MIT): Same SSVC scoring, idiomatic TypeScript. Zero deps.
- Breach Notes (MIT): Curated post-mortems of public breaches, in plain English. Subscribe via RSS or read the source on GitHub.
The CRIT draft on the IETF datatracker · Breach Notes RSS feed
Rules you can read, test and fork
Every SAST, secrets and IaC rule in the CLI is OPA Rego. The community packs below load straight from Git with one flag, and a public test suite keeps the built-in rules honest.
vulnetix scan --rule vulnetix/opa-aquasecurity-trivy
- community-rules: community Rego SAST rules
- sast-rule-evals (Apache-2.0): test cases for the built-in SAST rules
- opa-aquasecurity-trivy (Apache-2.0): Trivy checks as Rego
- opa-checkmarx-kics (Apache-2.0): KICS intent rules
- opa-fugue-regula (Apache-2.0): Regula IaC rules
- opa-snyk-labs-iac (Apache-2.0): IaC rules
- opa-cds-aws-tf (Apache-2.0): AWS Terraform rules
- opa-cigna-tf (Apache-2.0): Terraform rules
- opa-gosec: gosec rules as Rego
- opa-py-ruff: Ruff rules as Rego
The building blocks underneath
- malscan-engine: The Go module behind malscan: four detector families that read installed dependency bytes and return explainable verdicts.
- vdb-cyclonedx: A Go parser and builder for CycloneDX 1.2 to 1.7, used wherever Vulnetix reads or writes an SBOM, CBOM or AI-BOM.
- tea-insights: The data layer behind TEA Insights, where every count is labelled with the CEL predicate that produced it.
- sca-manifest-fixtures: Real manifests and lockfiles for more than 30 package managers, the fixtures the SCA scanner is tested against.
- Malscan STIX feeds: Per-ecosystem STIX 2.1 indicators of malicious domains and URLs, refreshed every 15 minutes with sha256 sidecars.
- homebrew-tap and scoop-bucket: The install channels for macOS, Linux and Windows, with every formula and manifest public (AGPL-3.0).
Install anywhere
Every channel is public too.
PRs welcome across the Vulnetix GitHub org. Found a vulnerability in one of our projects? Report it through the disclosure programme.
- Homebrew:
brew install vulnetix/tap/vulnetix - Scoop:
scoop install vulnetix - Nix:
nix profile install github:Vulnetix/cli - Go:
go install github.com/vulnetix/cli/v3@latest - GitHub Actions:
uses: Vulnetix/cli@v3 - Editors and browsers: Open VSX, Chrome and Firefox