vigil - The Security Agency That Never Sleeps — AI-powered

项目说明

Vigil

The Security Agency That Ne.

![Node 18+]()
![Support]()

Open-source, AI-powered security operations platform. scanning, autonomous agents, incident response, compliance tracking, and MCP server — all in a single Express.js process.

Nmap + Nuclei + Trivy + Nikto + OpenSSL + DNS

6 npm dependencies. No React. No build step. BYOK AI.

---

Website | GitHub | Docs | Twitter | ♥ Tip Jar

---

Built by Autopilot AI Tech LLC

---

Features

6 Built-in Scanners — Nmap, Nuclei, Tri, OpenSSL, DNS/WHOIS — no external dependencies

20 Autonomous Agents — Run parallel security campaigns with scheduling

Incident Response — Full lifecycle workflow with playbooks, timeline, and AI postmortems

Compliance Tracking — SOC 2, ISO 27001, NIST 800-53, PCI-DSS, HIPAA

MCP Server — 25+ tools, 3 resources, 4 prompts for Claude Desktop/Code/Cursor

BYOK AI — Bring your own Claude or Codex CLI. Zero AI cost baked in

Works without a database — JSON file stores by default, optional PostgreSQL

RBAC + 2FA — Admin, Analyst, roles with TOTP two-factor auth

Credential Vault — AES-256-GCM encrypted storage

30 Views — Glass-themed dashboard with real-time Socket.IO updates

Quick Start

Option 1: npm (bare metal)

Option 2: Docker Compose

This starts Vigil + PostgreSQL 17. Scanner tools (nmap, nuclei, tri) are included in the Docker image.

Option 3: Docker (standalone)

Prerequisites (bare metal)

Node.js 22+ and npm

Scanners (optional, for full functionality):

- nmap — network scanning
- nuclei — scanning (9000+ templates)
- trivy — container/filesystem scanning
- nikto — web ser
- openssl — certificate analysis
- dig + whois — DNS reconnaissance

Docker CLI (optional, for container security scanning)

PostgreSQL 17 (optional — works without it using JSON file stores)

AI CLI (optional — claude or codex for AI features)

See CLAUDE.md for the full bare metal install guide.

Features

Scanning & Management

Network Scan — Nmap port scanning, host discovery, service detection, OS fingerprinting

Scan — Nuclei template-based scanning with se filtering

Container Scan — Tri/filesystem scanning, SBOM generation

Web Scan — Nikto web ser detection

SSL Audit — Certificate chain , cipher suite grading, protocol testing

DNS Recon — DNS enumeration, zone transfer, WHOIS lookup

Scheduled Scans — Cron-based recurring scan configuration

Intelligence & Hunting

Threat Intelligence — RSS feed ingestion, IOC matching, ad profiles

Threat Hunting — AI-assisted hypothesis testing, MITRE ATT&CK mapping

OSINT — Domain, IP, email, and infrastructure reconnaissance

C — C search, C, affected assets

Incidents & Response

Incident Management — Full lifecycle workflow with se, assignment, timeline

Playbooks — Pre-built response templates (ransomware, phishing, data breach, DDoS)

Attack Timeline — Event correlation and

Postmortem — AI-generated post-incident review with lessons learned

Agents & Campaigns

20 Built-in Agents — From scanning to compliance auditing

Campaign Mode — Run multiple agents in parallel with scheduled execution

AI Triage — Automated prioritization and remediation guidance

Compliance & Reporting

Compliance Frameworks — SOC 2, ISO 27001, NIST 800-53, PCI-DSS, HIPAA

Policy Editor — Security policy CRUD with enforcement rules

Reports — PDF, JSON, CS with scheduling

Audit Log — Immutable audit trail with filtering and export

System

Terminal — Embedded terminal for manual scanner commands

Credentials Vault — AES-256-GCM encrypted credential storage

Knowledge Base — Notes and FAQ for team knowledge sharing

MCP Playground — Interactive tool testing for Claude Desktop/Code/Cursor

Notifications — Real-time alerts .IO

RBAC — Admin, Analyst, roles with 2FA (TOTP)

Screenshots

<details>
<summary>Click to expand all screenshots</summary>

| View | Screenshot |
|------|-----------|
| Dashboard | !Dashboard |
| AI Terminal | !AI Terminal |
| Security Agents | !Security Agents |
| Campaigns | !Campaigns |
| Findings | !Findings |
| Threat Feed | !Threat Feed |
| Threat Hunt | !Threat Hunt |
| OSINT | !OSINT |
| Attack Timeline | !Attack Timeline |
| Alert Triage | !Alert Triage |
| Compliance | !Compliance |
| Playbooks | !Playbooks |
| Pentest | !Pentest |
| Reports | !Reports |
| Audit Log | !Audit Log |
| Credentials Vault | !Credentials |
| Knowledge Base | !Knowledge Base |
| MCP Playground | !MCP Playground |
| Notifications | !Notifications |
| Settings | !Settings |
| Vigil AI | !Vigil AI |

</details>

Architecture

Signal System

Cyan (#22d3ee) — secure, healthy, passing, active

Orange (#ff6b2b) — threat, , warning, critical

Auth

PBKDF2 password hashing

Session tokens in cookies () or Bearer header

Optional TOTP 2FA

RBAC: admin, analyst,

AI Integration (BYOK)

Users bring their own AI subscriptions. Vigil shells out to locally-installed CLI tools:

Claude CLI (claude --print) — requires Anthropic subscription

Codex CLI (codex) — requires OpenAI API key

None — AI features disabled, graceful degradation

MCP Server

Vigil includes a built-in Model Context Protocol server at POST /mcp (Streamable HTTP transport).

Connect from Claude Desktop, Claude Code, Cursor, or any MCP client:

25+ Tools

Scanning (nmap, nuclei, tri, SSL, DNS) • (search, get, list CVEs) • Assets (list, details, disco) • Docker (list containers, inspect, scan image) • Compliance (check framework, policy status) • Incidents (create, update, timeline) • Reports (generate, get scan results) • System (posture score, metrics, alerts)

3 Resources

vigil://security-posture • vigil://scan-summary • vigil://

4 Prompts

security_audit • incident_response • • compliance_review

Configuration

Copy .en to .env and customize:

| | Default | Description |
|----------|---------|-------------|
| | 4100 | Server port |
| | admin | Default admin username |
| | auto-generated | Bootstrap admin password. Set it explicitly or read the startup logs on first launch. |
| DATABASE_URL | — | PostgreSQL connection string (optional) |
| AI_PROVIDER | — | claude-cli or codex (optional) |
| ENCRYPTION_KEY | auto | 32-byte hex for credential vault |
| DOCKER_HOST | — | Docker socket path for container scanning |

Scanners

| Scanner | Purpose | Install |
|---------|---------|---------|
| Nmap | Network scanning, port discovery, service detection | apt install nmap |
| Nuclei | Template-based scanning (9000+ templates) | projectdiscovery/nuclei |
| Trivy | Container/filesystem vuln scanning, SBOM, secrets | aquasecurity/trivy |
| Nikto | Web ser detection | apt install nikto |
| OpenSSL | Certificate chain analysis, cipher grading | Pre-installed on most systems |
| dig/whois | DNS reconnaissance, WHOIS lookup | apt install dnsutils whois |

Testing

Contributing

See CONTRIBUTING.md for de setup and guidelines.

License

AGPL-3.0 — free for personal and commercial use. If you modify and deploy Vigil as a service, you must open-source your modifications.

Safety

Only scan targets you own or ha authorization to test.

Keep credentials out of AI prompts.

Change the default admin password immediately after first login.

Use the built-in credential vault for sensitive data (AES-256-GCM encrypted).

项目信息

开发语言：JavaScript

Star 数：18

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The Security Agency That Never Sleeps — AI-powered security operations platform展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。