`vulkro analyze`

Advisory only, opt-in, local by default

vulkro analyze runs the same deterministic scan as vulkro scan, then, only when you pass --ai, layers a graph-guided AI second pass on top of it. The second pass is advisory: it never changes a deterministic finding, its severity, the table / json output, the published benchmark, or the exit code, and the default model is a local qwen2.5-coder:7b served by Ollama on your own machine, so nothing leaves the box. Capability ai-assist, and it is Free.

The analyze command runs the deterministic scan first, then (with --ai) investigates only the handful of graph nodes where the engine is structurally weak or deliberately silent: business-logic intent, unknown-reachability taint, missing controls, and authorization intent. These are the four buckets vulkro ai targets ranks, and analyze is what actually calls a model against them.

Its candidates are tagged advisory, non-deterministic, and excluded-from-benchmark. They are NEVER merged into the deterministic findings, and they NEVER move the exit code, which is driven by the deterministic scan alone. In this release every candidate is the unvalidated LlmOnly tier: the deterministic validator that promotes tiers is a later phase.

A local (loopback Ollama) model is the default and is allowed even under VULKRO_OFFLINE, because nothing leaves the machine. A cloud endpoint is refused offline. Without --ai, analyze prints the deterministic scan summary only.

Usage

vulkro analyze [PATH] [FLAGS]

Arguments

Argument	Description	Default
`PATH`	Project path to scan.	`.`

Flags

Flag	Description	Default
`--ai`	Run the AI second pass after the deterministic scan. Without it, `analyze` prints the deterministic scan summary only.	off
`--no-ai`	Disable the AI layer for this run (deterministic scan summary only). Always wins over `--ai`.
`--ai-model <MODEL>`	AI model tag override (highest precedence). Overrides `VULKRO_AI_MODEL`, the saved `vulkro ai use` selection, and the smart default.
`--ai-url <URL>`	AI runtime base url override (OpenAI-compatible). A loopback url is allowed under `VULKRO_OFFLINE`; a cloud url is refused offline.
`--ai-max-targets <N>`	Cap the number of targets the second pass investigates (the token gate). Sized for a local 7B.	`12`
`--ai-budget <TOKENS>`	Cap the running token budget for the whole second pass. Sized for a local 7B context window.	`24000`
`--format <FORMAT>`	`table` (the advisory banner plus candidates) or `json` (the full `AiSecondPassReport`).	`table`
`--offline`	Hard-disable every outbound network call for this run (sets `VULKRO_OFFLINE=1`). A loopback model (`http://127.0.0.1`, `http://localhost`) is still allowed; a cloud endpoint is refused. Equivalent to exporting `VULKRO_OFFLINE=1`, and the flag wins when both are set.	off

The model and runtime resolve in the same order as every other AI-capable command: per-run flags, then VULKRO_AI_MODEL / VULKRO_AI_URL / VULKRO_AI_KEY, then the saved vulkro ai use selection, then the smart default (qwen2.5-coder:7b, falling back to phi4-mini:3.8b on a constrained machine, never the non-commercial qwen2.5-coder:3b). See vulkro ai for setup and model selection.

Exit codes

Driven by the DETERMINISTIC scan only. Advisory candidates never change it.

0 scan completed, no findings (advisory candidates do not change this).
1 scan completed, findings were reported.
2 error: bad args, IO failure, or an internal error.

Examples

# Deterministic scan summary only, no model called.
vulkro analyze .

# Run the graph-guided AI second pass over the weak-spot buckets.
vulkro analyze . --ai

# Air-gapped: a loopback model is still allowed, a cloud endpoint is refused.
vulkro analyze . --ai --offline

# Machine-readable advisory report.
vulkro analyze . --ai --format json

# Tighten the token gate for a small local model.
vulkro analyze . --ai --ai-max-targets 6 --ai-budget 12000

vulkro ai - configure the local model and see the ai targets buckets this second pass investigates.
vulkro scan - the deterministic pipeline analyze runs first, and whose exit code it inherits.
vulkro triage - the advisory triage lens that uses the same model configuration.
Air-gap: offline mode - VULKRO_OFFLINE, and why a loopback model is still allowed under it.

Command reference

Generated from vulkro help analyze on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Run the scan, then optionally let a local model investigate the few spots the scanner is unsure about.

Run the deterministic scan, then (with `--ai`) a graph-guided AI second pass that investigates only the handful of graph nodes where deterministic analysis is inconclusive (business-logic intent, unknown-reachability taint, missing controls, authz intent).

The second pass is ADVISORY. Its candidates are tagged advisory / non-deterministic / excluded-from-benchmark, are NEVER merged into the deterministic findings, and NEVER move the exit code (which is driven by the deterministic scan alone). A local (loopback Ollama) model is the default and is allowed even under VULKRO_OFFLINE because nothing leaves the machine; a cloud endpoint is refused offline. In this release every candidate is tier `LlmOnly` (unvalidated): the deterministic validator that promotes tiers is a later phase.

Model selection reuses the same flags as `scan` / `triage` (`--ai-model` / `--ai-url` / `--no-ai`) and honours VULKRO_AI_MODEL / VULKRO_AI_URL / VULKRO_AI_KEY and the saved `vulkro ai use` selection.

Exit codes, from the DETERMINISTIC scan only: 0  scan completed, no findings (advisory candidates do not change this). 1  scan completed, findings were reported. 2  error (bad args, IO failure, internal error).

Usage: vulkro analyze [OPTIONS] [PATH]

Arguments:
  [PATH]
          Project path to scan. Defaults to the current directory
          
          [default: .]

Options:
      --ai
          Run the AI second pass after the deterministic scan. Without it, `analyze` prints the deterministic scan summary only

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --ai-model <MODEL>
          AI model tag override (highest precedence). Overrides VULKRO_AI_MODEL, the saved `vulkro ai use` selection, and the smart default

      --ai-url <URL>
          AI runtime base url override (OpenAI-compatible). A loopback url is allowed under VULKRO_OFFLINE; a cloud url is refused offline

      --no-ai
          Disable the AI layer for this run (deterministic scan summary only)

      --format <FORMAT>
          Output format: `table` (default; the advisory banner + candidates) or `json` (the full AiSecondPassReport)
          
          [default: table]

      --ai-max-targets <N>
          Cap the number of targets the second pass investigates (the token gate). Defaults to the built-in budget (12), sized for a local 7B

      --ai-budget <TOKENS>
          Cap the running token budget for the whole second pass. Defaults to the built-in budget (24000), sized for a local 7B context window

  -h, --help
          Print help (see a summary with '-h')

Usage​

Arguments​

Flags​

Exit codes​

Examples​

Related​

Command reference​