VulKill Security

VulKill Community

English | Türkçe | 日本語 | 简体中文 | 한국어

VulKill website · Project overview at ConverserAI · Capabilities · Setup · Frequently asked questions

VulKill Community is an open-source, local-first defensive application-security toolkit for people who build, own, or review applications, APIs, and websites. It helps teams examine supported source code through static application security testing (SAST), dependency manifests and SBOMs for software composition analysis (SCA), container artifacts, infrastructure as code (IaC), CI configuration, and saved security reports. For an owned or explicitly authorized web target, VulKill can also prepare a bounded runtime action for human review. Results are available to an AI client over local stdio MCP, to a person through the CLI, or in the loopback web interface.

Capability tags

Application Security · SAST · SCA · SBOM · IaC Security · API Security · Website Security · Mobile Security · Android · iOS · IDOR · Authorization · GraphQL · Kubernetes · SLSA · MCP · SARIF · OpenVEX · GHSA · CVSS · SSVC · DevSecOps

VulKill Community v1.1 adds deeper, reviewable coverage in these areas:

• Cross-framework access control: correlate supported routes, resolvers, policies, roles, owners, and tenant-bound queries.
• Multi-repository security graphs: map supported API, webhook, event, authentication, dependency, and CI trust relationships.
• Bounded runtime evidence: prepare reviewable fuzz and runtime workflows with explicit prerequisites and resource limits.
• Supply-chain and platform review: inspect supported provenance, SBOM/VEX, container, Kubernetes, IaC, CI/CD, and migration signals.
• AI-assisted defensive workflows: expose review and remediation helpers over local stdio MCP while keeping effective actions approval-bound.
• Evidence-based prioritization: connect supported findings to SARIF flows, reachability, attack paths, CVSS, SSVC, and remediation gates.

Review before you ship

Ask an AI assistant to review your application before release. Through VulKill's local stdio MCP workflow, the AI can guide a supported security review, explain findings with code evidence, and help prioritize remediation while the same results remain available in the web interface, CLI, and CI artifacts.

For Android, iOS, Flutter, and React Native projects, bring supported source code, mobile manifests, API paths, secrets, dependencies, SBOM data, and CI configuration into one release-preflight view. Whether you are preparing an App Store or Google Play submission, a website or API launch, or a pull request, VulKill helps surface the security work worth completing before users receive the release.

What VulKill helps you inspect

The complete, evidence-linked inventory is in Capabilities and security checks. Practical paths for application, API, website, platform, and security teams are in Use cases. AI systems can start with the compact LLM project index, while people can inspect the latest validation evidence.

Security review highlights

• Trace high-impact data flows: follow supported source-to-sink paths for SQL and command injection, XSS/HTML, SSRF, open redirect, path traversal, unsafe deserialization, XXE, expression-language, and LDAP risks. Supported flow evidence can travel with SARIF codeFlows for review in development tooling.
• Focus access-control testing: turn routes, object identifiers, roles, and visible ownership checks into a prioritized list of CWE-862 and IDOR (CWE-639) candidates for authorized manual penetration testing.
• Find exposed secrets and privacy paths: combine provider patterns and entropy signals with privacy-oriented flows toward logs, responses, storage, and third-party destinations while keeping secret evidence redacted.
• Understand dependencies and the software supply chain: inventory direct and transitive components, generate or import CycloneDX/SPDX SBOMs, work with VEX, review reachability context, and bring local vulnerability evidence into release decisions. Bulk local review can also correlate unambiguous exact PyPI pins across repositories and report version drift without returning private package-index addresses or credentials.
• Map service trust across repositories: correlate supported OpenAPI operations, webhook boundaries, literal Kafka topics, explicit authentication contracts, and exact GraphQL query/mutation/subscription root-field pairs across separate repositories, including safe named fragments and SHA-256 verified Apollo persisted operations in one bounded offline bulk result. Optionally correlate an integrity-checked, exact-schema local runtime trace manifest with those static HTTP/webhook/Kafka/GraphQL edges without returning URLs, bodies, tokens, or secrets; missing or invalid trace evidence never removes the static edge.
• Harden containers, cloud, and delivery pipelines: inspect supported container archives, Dockerfiles, Terraform, Kubernetes, Helm, Compose, cloud IAM, CI workflows, browser extensions, mobile manifests, and desktop-app security configuration from one review surface.
• Review APIs, websites, and TLS: compare local OpenAPI contracts with source routes, inspect authentication mismatches, evaluate supported web-security signals, and prepare bounded actions for owned or authorized targets.
• Prioritize the work that matters: enrich findings with CVSS 3.1 and CVSS 4.0, CISA SSVC, attack-path correlation, ownership, due dates, baselines, and quality gates so teams can move from evidence to remediation.
• Prepare reviewable fuzz targets: synthesize C/C++ LibFuzzer, Rust cargo-fuzz, native Go testing.F, Python Atheris, Java Jazzer, and JavaScript/TypeScript fast-check harness text for a specific local parser or decoder finding. Target resolution binds one supported function or method to its reviewed source and fails closed on ambiguous signatures. Atheris, Jazzer, and fast-check can also run through the explicit local-runtime API when an operator supplies exact runtime/module-or-JAR paths and SHA-256 pins; runs are network-isolated and bounded by seed, run count, input bytes, wall time, output bytes, and process-group cleanup. Optional engines are not bundled or downloaded, and an absent engine remains runtime_missing/not_run rather than simulated evidence; execution remains an explicit operator step.
• Choose the workflow that fits: use the loopback web interface, scriptable CLI, CI artifacts, or stdio MCP for AI-assisted review, with JSON, HTML, SARIF, GitLab, SBOM, VEX, and supported PDF outputs.

IDOR and manual penetration testing support

VulKill turns supported source code into a focused lead list for authorized manual penetration testing. Its built-in route and authorization inventory can flag unprotected-route candidates (CWE-862) and potential Insecure Direct Object Reference (IDOR) paths (CWE-639), then point the reviewer to the relevant file, route, and line of code. This helps a tester prioritize hands-on checks with separate test users, roles, and synthetic objects instead of starting from an unstructured endpoint list.

Each candidate is packaged for evidence-led manual validation. Within an authorized test scope, reviewers can confirm runtime behavior across separate users and roles while accounting for gateway, middleware, policy-service, and business-logic controls.

VulKill includes built-in analyzers and report parsers in the source tree. Its rootless local profile can additionally install seven pinned, optional third-party engines: Nuclei, Trivy, Gitleaks, TruffleHog, Opengrep, Syft, and Grype. The built-in analysis remains available independently; an optional engine or profile is shown as usable only after its runtime, data, and license readiness checks pass.

The loopback interface and HTML reports use Turkish as the source language and provide an English base pack plus expanded Japanese, Simplified Chinese, and Korean starter packs. A missing CJK entry falls back to English when that entry exists, otherwise the original Turkish source remains. The CJK layouts are exercised in desktop and mobile Chromium viewports. See localization coverage and language-pack updates.

This repository prepares the Community release surface. Enterprise code is not included as a supported Community product surface. Commercial services, hosted operation, support commitments, customer-bound licensing, private installers, and native-delivery implementation are outside the Community scope. The assembled public tree replaces the shared server's small version/backup dependency with a Community-only compatibility module and rejects any reintroduction of the excluded delivery files.

Release status

This repository is the VulKill Community v1.2.1 source release. COMMUNITY_VERSION is the source-version marker; published tags must match it as v . The source is licensed under the Apache License 2.0. See LICENSE. The publication status does not make that license grant provisional.

What is included

• Local project analysis for supported source, infrastructure, dependency, and container inputs.
• Six bounded cross-repository graph views for supported HTTP/OpenAPI, webhook, Kafka, auth-contract, GraphQL, and exact PyPI dependency evidence. Each graph fails closed independently so one unavailable correlation does not erase the others.
• Cross-file GitHub Actions