Documentation

Welcome to the Vulnetix CLI documentation. Choose a section to get started.

What’s new

• AI Firewall — policy enforcement on AI traffic — vulnetix ai-firewall install points the AI clients on a machine (shell, project env, Claude Code, Codex, Continue, aider) at a hosted OpenAI-compatible gateway that screens every request against the organisation’s policy: which providers and models may be called, and what may appear in a prompt. Your provider key stays server-side, encrypted; clients carry only a Vulnetix key. status finds the clients whose traffic is bypassing the firewall entirely — and the guardrails that look enforced but are not — and apply reconciles the whole policy from a committed YAML file. See AI Firewall.
• Malscan — local malware scanning — vulnetix malscan runs the malscan-engine in-process over your installed dependencies (node_modules, site-packages, vendor, ~/.cargo, …): a STIX IOC filesystem scan, manifest/install-script pattern detection, IOC extraction, and known-bad artifact hashing, all on the bytes on disk. It emits SARIF and exits non-zero on malware, and runs automatically inside scan (and sca/scan --block-malware). See Malscan.
• AIBOM — AI coding-agent discovery — vulnetix aibom discovers AI coding agents/assistants (42+ tools), AI SDK usage per language, and the model names invoked, then emits a CycloneDX AI Bill of Materials. Model names are extracted by anchoring on the SDK parameter, so unknown/future models are captured. See AIBOM.
• CBOM — cryptography & post-quantum readiness — vulnetix cbom discovers cryptographic usage across source, config, certificates and crypto libraries, and emits a CycloneDX Cryptography Bill of Materials. Each algorithm is classified quantum-safe / quantum-vulnerable / deprecated / hybrid with its NIST quantum-security level and a per-country approval matrix (NIST, CNSA 2.0, BSI, ACSC, …). Use --fail-on quantum-vulnerable to gate CI. See CBOM.
• Tree-sitter reachability — Every vulnetix vdb vuln lookup now runs CVE-specific tree-sitter queries against your project, reporting exact file:line:line matches for the vulnerable pattern. Direct mode confirms the pattern is in the installed package; transitive mode finds first-party callers. 17 languages bundled. See Reachability Analysis.
• VDB API v2 is the default — Previous releases defaulted to -V v1; current releases default to v2. The v2 surface adds timelines, scorecards, KEV merging, parallel fixes, and the tree-sitter queries powering reachability. Pass -V v1 only when explicitly required; v1 will be removed in a future release.