Vulnetix scans a repository for vulnerable dependencies, code flaws, secrets, IaC and container misconfigurations, licence conflicts and malware, then tells you which findings affect the version you run and the lowest version that fixes them. It is for developers who want that answer on their own machine, and for teams who run the same scan in CI and track the results in the Resolve Platform.

• Install
• First scan
• GitHub Action
• Other CI/CD platforms
• Pix for coding agents
• Configuration
• Development
• Contributing
• Documentation
• License

Architectures: AMD64, ARM64, ARM and 386.

The install script installs the binary only when its SHA-256 matches the release's checksums.txt, and stops when it cannot check. With cosign on PATH it also verifies the release's signed SLSA provenance; --require-provenance makes that mandatory. See docs/curl.md for the flags and for verifying a manual download.

Analytics. After a successful install, the install script sends one anonymous event to Google Analytics with the OS, architecture, CLI version and a random id made for that install. The CLI sends anonymous usage events too. Set VULNETIX_NO_ANALYTICS=1 or DO_NOT_TRACK=1 to turn both off, or pass --no-analytics to a single command.

vulnetix auth login && vulnetix scan

vulnetix auth login opens a browser to sign in. It is optional: without it, scans run in community mode on a shared quota. vulnetix scan scans the current directory. On a project whose requirements.txt pins requests==2.25.0 and jinja2==2.11.2:

Querying VDB via /v2/cli.sca: 2 unique package(s) in 1 batch(es)...
vulnetix scan: FINDINGS  9 advisories, 2 packages, 2 need action

NEEDS ACTION
  CRITICAL  jinja2 2.11.2 -> 3.1.6      CVE-2024-34064 +4   PoC-exploit   ./requirements.txt
  CRITICAL  requests 2.25.0 -> 2.33.0   CVE-2026-25645 +3   PoC-exploit   ./requirements.txt

vulnetix scan: CLEAN  no sast findings
  [OK] BOM:      ./.vulnetix/sbom.cdx.json
  [OK] Memory:   ./.vulnetix/memory.yaml

Each row is one package: the version to move to clears every advisory on it. vulnetix fix applies those upgrades and rescans, and vulnetix --help lists every command by group.

name: Security scan
on: [pull_request]
permissions:
  contents: read

jobs:
  vulnetix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: Vulnetix/cli@v4
        with:
          task: sca
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}

@v4 installs the newest v4 release. The action checks the binary's SHA-256 and, by default, installs cosign and verifies the release's signed provenance (verify-provenance: true).

To upload a report you already have:

- uses: Vulnetix/cli@v4
  with:
    org-id: ${{ secrets.VULNETIX_ORG_ID }}
    api-key: ${{ secrets.VULNETIX_API_KEY }}
    task: upload
    upload-file: ./reports/results.sarif

The task input takes:

Most tasks also have their own action, such as Vulnetix/cli/sca@v4, with artifact, attestation and release steps. See docs/github-actions.md for every input and docs/GHA_COMMAND.md for uploading workflow artifacts.

Pix wires Vulnetix into the coding agents on your machine (Claude Code, Codex and others): hooks that check a dependency before it lands and a commit before it records a credential, and skills for work that needs your working tree, such as fixing a finding and checking the fix landed.

vulnetix agent install

It detects the agents, writes each one's hook config and skills, and configures the Vulnetix MCP server where the agent speaks MCP. In Claude Code you can install the plugin instead:

/plugin marketplace add Vulnetix/pix-ai-coding-assistant
/plugin install vulnetix@vulnetix-plugins

See the Pix documentation and the Pix repository.

go build -o vulnetix .
just test

just test runs go test ./.... Go 1.25 or newer is required (see go.mod). The justfile lists the other recipes, including the generators for docs and actions.

Open an issue or a pull request at github.com/Vulnetix/cli. Run just test before you send a change, and regenerate any generated file you touch (the justfile and AGENTS.md say which).

• CLI documentation
• Pix documentation
• VDB API
• Installation guides
• Distribution
• GitHub App

AGPL-3.0