vulsight - AI-Powered Source Code Vulnerability Scanner

项目说明

— AI-Powered Source Code Scanner

<p align="center">
<img src=" alt="Python 3.11+">
<img src=" alt="MIT License">
<img src=" alt="FastAPI">
<img src=" alt="Semgrep">
<img src=" alt="Claude AI">
</p>

is a hybrid scanner that combines Semgrep static analysis rules with Claude AI deep code analysis to find security in source code. Built for security researchers and bug hunters.

Features

Hybrid Scanning — Semgrep rules + Claude AI analysis for maximum co

Multi-Language — PHP, Ja, Python, Ruby, Java

6 Input Methods — Paste code, upload file, upload folder, upload ZIP, local path, Git URL

Auto C — CVSS 3.1 and score for each finding

POC Generation — AI-generated proof-of-concept exploits

PDF Reports — Professional reports

C — Auto-generate CVE JSON 5.x templates for submission

Web Dashboard — Track projects, scans, and findings

Co

| Language | Key |
|----------|-------------------|
| PHP | SQLi, XSS, RCE, LFI/RFI, Deserialization, SSRF |
| Ja | XSS, Prototype Pollution, SSRF, NoSQL Injection, Command Injection |
| Python | Code Injection, SSTI, Command Injection, SQLi, Deserialization |
| Ruby | Mass Assignment, Command Injection, SQLi, XSS |
| Java | Deserialization, XXE, JNDI Injection, SQLi, EL Injection |

Quick Start

Option 1: Docker (Recommended)

Option 2: Manual Install

Usage

1. Create a Project

Go to Projects → Create a new project to organize your scans.

2. Start a Scan

Go to New Scan → Choose your input method:

| Method | Description |
|--------|-------------|
| Paste Code | Paste source code directly |
| Upload File | Upload a single source file |
| Upload Folder | Select an entire project folder |
| Upload ZIP | Upload a zipped project |
| Local Path | Enter path to a local folder |
| Git URL | Clone and scan a Git repository |

Choose scan type:

Rules Only — Fast, free, uses Semgrep patterns (no API key needed)

AI Only — Deep analysis using Claude AI

Hybrid — Both combined (recommended, best results)

3. Review Findings

Each finding includes:

type, CWE ID, se, C

code snippet with line numbers

Attack scenario and remediation advice

AI-generated proof-of-concept (POC)

4. Generate C

For confirmed , generate a CVE JSON 5.x template ready for submission to MITRE.

5. Export PDF Report

Generate professional PDF reports for documentation and disclosure.

Configuration

Set these in .env or via the Settings page ():

| | Default | Description |
|----------|---------|-------------|
| ANTHROPIC_API_KEY | — | Your Anthropic API key (for AI scanning) |
| AI_MODEL | claude-sonnet-4-20250514 | Claude model to use |
| AI_MAX_CONCURRENT | 3 | Max parallel AI requests |
| SEMGREP_TIMEOUT | 60 | Semgrep timeout in seconds |

Tech Stack

| Component | Technology |
|-----------|-----------|
| Backend | Python 3.11+ / FastAPI |
| Frontend | Jinja2 + HTMX + Tailwind CSS + Alpine.js |
| Database | SQLite (SQLAlchemy ORM) |
| Rule Scanner | Semgrep |
| AI Scanner | Claude API (Anthropic) |
| PDF Reports | WeasyPrint |

Project Structure

For Bug Hunters

is designed for finding in open-source projects:

1. Clone a target repository
2. Scan with Rules Only first (fast, free)
3. Review findings and mark false positives
4. Re-scan interesting files with AI Only for deeper analysis
5. Generate POCs for confirmed
6. Create C and submit to MITRE
7. Generate PDF report for responsible disclosure

Disclaimer

This tool is intended for authorized security testing and responsible research only. Always:

Get proper authorization before scanning

Follow responsible disclosure practices

Respect the terms of service of target software

Report to before public disclosure

License

MIT License — see LICENSE for details.

Contributing

Pull requests welcome! Please open an issue first to discuss proposed changes.

项目信息

开发语言：Python

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-Powered Source Code Vulnerability Scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。