vulkro scan
How to run vulkro scan: presets, output formats, CI gating with --fail-on, baselines, and every environment variable the scan honours.
inspect
Surface the malicious-capability shapes in a just-cloned project so a human can review them before running any of its code.
vulkro discover
Map your API surface - extract every HTTP endpoint without running any security scan.
dataflow
Document data flows. For every input surface (REST endpoints plus events), vulkro dataflow traces the functions and classes the data passes through
vulkro diff
Compare the current API surface and findings against a saved scan or a git branch, tag or commit, and get a per-finding list of what was added, fixed or unchanged.
--diff-only
PR-speed mode. Restricts the scan to files that differ vs the given git ref.
gate
How vulkro gate fails a build only on findings that are new compared with a branch or commit, so existing debt never blocks a change.
guard
In-loop security guard for AI coding agents. vulkro guard scans files as the agent writes them and feeds findings back so the agent regenerates until the
ci
Produce a CI-friendly Markdown report: endpoints, findings, and a surface diff if you pass a base ref.
vulkro container
Scan a built container image's installed packages against the local CVE bundle. Supports apk + deb (rpm coming soon).
vulkro scan-port
Inventory every process on the host that has bound a TCP LISTEN socket or a UDP port.
ctx
Read code for AI agents: one function, a range or an outline, every usage, what depends on a name, and what an edit broke.
explain
Explain a finding with framework-aware remediation guidance. Pass a finding ID (from vulkro scan --format json) or an OWASP API category code and Vulkro
vulkro fix
Fix suggestions in three tiers, strictest first. By default vulkro fix is read-only: it prints a unified diff (or a machine-applicable JSON envelope) and
vulkro ai
The AI layer is opt-in and advisory. It never changes a deterministic finding, its severity, the JSON / SARIF / SBOM output, or an exit code
vulkro prove
Turn a static finding into a runnable proof. vulkro prove scans the project, then for each eligible finding EMITS a test file a developer can run to confirm
vulkro aggregate
Link evidence-graph exports from several repositories to surface candidate cross-repo flows.
vulkro triage
Every verdict vulkro triage prints is labelled advisory, non-deterministic, and excluded from the benchmark.
vulkro respond
Incident-response mode for the 3am advisory-drop workflow: given a package + version, or an advisory ID, in under a second
baseline
Run a scan and write a baseline JSON file (default .vulkro-baseline.json) that scan --baseline and scan --ratchet can compare against.
summary
Produce a concise, shareable executive summary of a scan.
login / account
The account commands. Vulkro scans on the Free tier with no account; signing in holds Pro, and your first sign-in starts a 14-day trial of the full product.
logout
Log out this device: delete the local device token and cached lease, then make a best-effort revoke call to the account server.
activate / machine-id
The license-file commands. These are the air-gap and enterprise path: they satisfy the account requirement without a browser login and work fully offline.
account
Show your Vulkro account: email, tier (Free / Pro / Team / Enterprise), seat (for example "seat 2 of 5"), expiry, offline-grace remaining, and last sync.
license-status
Show the current license state: sign-in status, tier, expiry, machine ID, and the feature checklist.
machine-id
Print this machine's Vulkro fingerprint (32 hex characters).
buy
How to request a Vulkro licence: the buy command opens a pre-filled email to the Vulkro team with your machine id, and a licence file comes back for you to install.
usage
Show your own local scan-history report: scans over time, findings by severity, codebase size (LOC), and your most-scanned projects.
sbom
Emit a Software Bill of Materials for the project. Same data as vulkro scan --format cyclonedx
match-cve
Match a Software Bill of Materials against the local CVE bundle and emit findings.
slopcheck
Slopsquatting and hallucinated-package check for an AI-generated dependency list.
report
Render an offline executive HTML report. Open it in a browser to read, or save as PDF for distribution.
export
Export the detected API surface in another format. Where vulkro discover shows the endpoint map interactively, export writes it out for another tool.
vulkro formats
The vulkro formats command: every standards-based output format Vulkro writes and the exact specification version each one follows (SARIF, CycloneDX, SPDX, JUnit).
vulkro compliance
Run a compliance evaluation against a profile. Each finding the security engine produced is mapped to the relevant control(s)
vulkro compliance-pack
Produce a self-contained audit-evidence directory mapping findings to specific SOC 2, ISO 27001, or HIPAA control IDs.
cra-bundle
Build a CRA (EU Cyber Resilience Act) readiness bundle: one zip stapling a CycloneDX and SPDX SBOM, an OpenVEX exploitability document
vulkro rbac
Emit a role-based-access-control matrix from your discovered endpoints
vulkro openapi
Generate an OpenAPI 3.1 specification from your discovered endpoints. The inverse of the spec-vs-code drift check baked into vulkro discover: instead of
mcp
The Model Context Protocol surface: run Vulkro as an MCP server that Claude Desktop, Cursor, Windsurf, Continue, and VS Code MCP clients can call.
vulkro mcp serve
Run Vulkro as a Model Context Protocol server. Once configured, Claude Code, Claude Desktop, Cursor, Windsurf, Continue, VS Code's MCP client
vulkro mcp-audit
Audit MCP host configs for supply-chain and credential-handling risks. MCP host configs (Claude Desktop, Cursor, Windsurf, VS Code, Cline, Continue, Gemini
vulkro scan-mcp-server
Scan MCP server SOURCE CODE for prompt-injection-shaped and tool-poisoning vulnerabilities.
vulkro extension-audit
Audit installed editor and browser extensions for supply-chain and permission risks.
vulkro rules
Discover, install, and manage community rule packs. Packs are ed25519-signed YAML files that participate in every subsequent scan.
catalogue
Export a contributor, module, or endpoint catalogue as CSV. Handy for spreadsheets, inventory reviews, and hand-off documents.
config
Inspect and explain Vulkro's static configuration.
init / install-hook
Two ways to wire Vulkro into your local git workflow so a scan runs before code leaves the machine.
install-hook
Install or update git hooks that run Vulkro before a commit or push.
graph
Show the module dependency graph as JSON. Useful for feeding the project structure into another tool or visualiser.
history
Show recent scan history. Lists the runs recorded locally so you can see what was scanned and when. Included in the 14-day trial and in Pro.
trends
Show trend snapshots saved with vulkro scan --save. Track how finding counts move over time for a project. Included in the 14-day trial and in Pro.
portfolio
Walk a directory of git repos, scan each, and roll the results up into a portfolio view. For security leads tracking risk across many projects at once.
vulkro contributors
Show contributor and ownership analytics for the project. Wraps git blame over endpoint and module files
notify
POST a scan summary to a webhook (Slack, Teams, or a generic JSON receiver).
intel
Threat-intelligence bundles shipped with Vulkro. Each subsystem maintains a small, curated catalogue baked into the binary (known-compromised npm packages
vulkro serve
How to open the local Vulkro console with vulkro serve, what it reads, and how to run it for a team without exposing it to the internet.
vulkro lsp
Run Vulkro as a language server so any editor with an LSP client (Neovim, Helix, Emacs, Zed, Sublime) shows findings inline as you open and save files.
vulkro probe
vulkro probe is a DAST tool. It sends real attack traffic to --base-url, including payload injection (reflected XSS, SSTI, parameter pollution
vulkro update
Refresh - or apply offline - the local CVE bundle, rule packs, and compliance frameworks. Three modes
cache / config
Two maintenance commands: cache manages the per-file extraction cache, and config inspects Vulkro's static pattern configuration.
bench
Run the detector fixtures: every positive fixture must fire its detector and every negative one must stay silent, so a rule regression is caught without a full test suite.