vuln-scout - AI-powered whitebox penetration testing plugin for

项目说明

<p align="center">
<img src=".png" alt="" width="280">
</p>

<h1 align="center"></h1>

<p align="center"><strong>Claude Code plugin for whitebox security review with deterministic quick scans, e , and portable reports.</strong></p>

<p align="center">
<a href="docs/feature-maturity.md"><img alt="stable quick scan" src="
<a href="docs/feature-maturity.md"><img alt="deep analyzers beta" src="
<a href="docs/feature-maturity.md"><img alt="auto fix experimental" src="
</p>

's stable promise is an offline quick scan, shared findings.json with stable keys and hotspot-aware findings, SARIF/Markdown/HTML/PR-comment/bundle reports, suppressions, and a CI fail-on gate. It writes audit-plan.md and re.json for re workflows and exposes structured Claude Code and Kuzushi surfaces.

For MCP hosts, also ships a local stdio MCP server with scanner, report, artifact, and Joern CPG tools. See docs/mcp.md.

runs scanner binaries and Joern CPGQL locally against the workspace you
provide. The stable quick path uses bundled rules and does not require a remote
service.

Prerequisites

5-Minute Demo

1. Install the runtime prerequisite:

2. the local runtime:

3. Scan the bundled app and render an HTML report:

Expected quick-profile result: four findings from bundled local rules.

| Se | Finding |
|---|---|
| high | Python SQL injection |
| high | Python command injection |
| medium | Browser XSS |
| medium | Express open redirect |

Stable Promise

See feature maturity for the full stability matrix.

| Capability | Status |
|---|---|
| Offline quick scan with bundled rules | Stable |
| Shared findings.json schema and stable keys | Stable |
| SARIF, Markdown, HTML, and bundle reports | Stable |
| Suppressions and CI --fail-on gate | Stable |
| Kuzushi structured tool surface | Stable |
| Joern, CodeQL, Slither, Tri deep analyzers | Beta when installed |
| Auto-fix, PoC, and mutation workflows | Experimental |

Install

Primary paths are documented in docs/install.md. The quickest product check is the demo abo that, use the Claude Code plugin command path.

Canonical Workflows

| Workflow | Command | Guide |
|---|---|---|
| Full audit | /:full-audit | First run |
| finding | /: | PR review |
| Report | /:report | CI |
| Scope repo | /:scope | First run |
| Diff review | /:diff | PR review |

Commands (15 total)

<details>
<summary>Ad commands</summary>

| Command | Maturity | Purpose |
|---|---|---|
| /:scan | beta | Run quick, deep, or audit scan profiles |
| /:mobile-audit | beta | Audit decompiled Android targets (jadx_out + apktool_out merged) |
| /:threats | beta | Build STRIDE threat models |
| /:sinks | beta | Find dangerous functions and output sinks |
| /:trace | beta | Trace source-to-sink data flow |
| /:propagate | beta | Find related instances of a confirmed pattern |
| /:create-rule | experimental | Generate custom Semgrep rules |
| /:org-memory-compile | experimental | Compile human-re org memory |
| /:mutate | experimental | Mutation-test security controls |
| /:auto-fix | experimental | Generate patches for findings |

</details>

Feature Maturity

| Surface | Stable | Beta | Experimental |
|---|---|---|---|
| Profiles | quick | deep, audit | custom-rules |
| Reports | SARIF, Markdown, HTML, PR comment, bundle | generated PoCs | generated exploit harnesses |
| Workflows | full-audit, , report, scope, diff | scan, threats, sinks, trace, propagate | create-rule, mutate, auto-fix |

Kuzushi Integration

The npm package exports Kuzushi tools that return structured results:

Kuzushi exposes the same 15 command names as the Claude plugin. Its structured schemas cover the common flags; ad re workflows still live in the Claude Code command prompts.

The report tool supports sarif, md, json, html, pr-comment, and bundle.

MCP Server

Use the bundled MCP server when an MCP host should call directly:

The ser , , , , , s, CodeGraph sidecar tools, , and . Joern and CodeGraph tools return structured una states when their binaries or indexes are not installed, and report content is opt-in to keep MCP responses compact.

Project Structure

35 Auto-Activated Skills

The plugin ships 27 knowledge skills plus 5 task skills under /skills/tasks/.

Audit Artifacts

Migration

Users upgrading from 3.x should read docs/migration-3.x-to-3.2.md. /whitebox-pentest:* aliases remain as deprecated shim files for one release and are shipped as a legacy plugin root.

License

MIT

项目信息

开发语言：Python

Star 数：25

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 22 skills, 7 autonomous agents. STRIDE threat modeling, OWASP 2025 coverage, polyglot monorepo support.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。