vulkro serve

Launch the desktop console - the web UI embedded into the binary, served by a local HTTP server, opening your browser to http://127.0.0.1:8723.

Usage

vulkro serve [--port 8723] [--no-browser]

Flags

Flag	Description	Default
--port <PORT>	Port to bind. If taken, the OS picks a free one.	8723
--no-browser	Don't auto-open the browser when ready.	(false)

What runs where

• HTTP server: on 127.0.0.1 only (never bound to 0.0.0.0).
• UI assets: embedded directly into the vulkro binary at build time. No separate web server, no static-file dir to ship.
• State: SQLite at platform-appropriate paths:
  • macOS: ~/Library/Application Support/Vulkro/vulkro-desktop.db
  • Linux: ~/.local/share/Vulkro/vulkro-desktop.db
  • Windows: %APPDATA%\Vulkro\vulkro-desktop.db

Tabs

The console exposes tabs for findings, privacy, access control, CSRF, injection, IaC, dependencies, secrets, git history, containers, package licences, OpenAPI score, compliance, trends, hotspots, contributors, compare-scans, and code quality.

See Desktop console -> for the full reference.

Stopping the server

Ctrl-C in the terminal. The server traps SIGINT and shuts down cleanly, flushing any in-flight scan to SQLite first.

Related

• Desktop console reference ->
• See also: Baselines explained - the UI's baseline-scan flag vs the CLI's .vulkro-baseline.json file.