Endor Labs Integration Guide

Integrate Endor Labs with Vulnetix. Use endorctl to scan dependencies with reachability analysis, export SARIF findings, and upload to Vulnetix for centralised risk management.

Run Endor Labs in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install endorctl
  run: |
    curl -s https://api.endorlabs.com/download/latest/endorctl_linux_amd64       -o endorctl && chmod +x endorctl

- name: Endor Labs scan
  run: |
    ./endorctl scan --namespace ${{ secrets.ENDOR_NAMESPACE }} --as-default-branch
    ./endorctl api get-vulnerabilities       --namespace ${{ secrets.ENDOR_NAMESPACE }} --sarif > endorlabs.sarif
  env:
    ENDOR_API_CREDENTIALS_KEY: ${{ secrets.ENDOR_API_KEY }}

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: endorlabs
    path: endorlabs.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Endor Labs's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Endor Labs. Keep running it. Vulnetix sits on top of Endor Labs (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Endor Labs is strongest at its core category and also carries features in SAST, Secret Scanning, Container & Image Scanning, SBOM Generation, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Endor Labs does well

• Function-level reachability analysis that filters out unreachable CVEs, cutting dependency alert noise by a claimed 80-92%
• Unified developer-first platform combining reachability SCA, SAST (rule-based Opengrep plus AI SAST), secrets, container scanning, and malicious-package detection in one product
• Strong remediation focus: upgrade-impact analysis and automated patching so bumps don't break the build
• AI model discovery and governance (finds AI models/usage in codebases) plus centralized SBOM and VEX generation

Where Vulnetix adds to it: Both center on reachability, but Vulnetix is an orchestration/ASPM layer that ingests and dedupes findings from Endor Labs alongside other scanners into one prioritised queue, adds broader exploit-intel (EPSS, CISA KEV, Coalition ESS, CWSS, LEV) and SSVC policy, immutable versioned VEX with audit, EOL policy, and an install-time package firewall across 25+ registries. Vulnetix layers on top of Endor Labs rather than replacing its function-level reachability engine.

No migration, no rip-and-replace. Endor Labs keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Endor Labs results in Vulnetix

Upload Endor Labs SARIF, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Endor Labs documentation ↗

Wire Endor Labs into your CI/CD pipeline →