What Is VulnHunter?
VulnHunter is open-source vulnerability scanning software that uses agentic AI to find and fix exploitable flaws in source code. Most traditional scanners flag suspicious patterns and leave security teams sorting through noise. VulnHunter reasons like an attacker instead, working forward through the code to determine whether a flaw is actually exploitable before it surfaces a finding.
The tool was developed internally at Capital One and released under an Apache 2.0 license. It runs as a set of Claude Code skills and requires Claude Opus for its multi-step reasoning. Security engineers, AppSec teams, and developers who need reliable, low-noise vulnerability scanning software will find it useful across codebases of any size.
Features & Benefits
- Attacker-First Entry Point Analysis: scan source code by starting at attacker-accessible entry points like APIs, network messages, and file uploads, then reason forward to assess true exploitability.
- Falsification Engine: run a structured disproof workflow against each potential finding; discard anything that relies on unsupported assumptions before surfacing it.
- Verified Finding Output: emit only high-priority defects that survive falsification, each with an executable exploit path and a confirmed attack capability description.
- Exploit Path Mapping: map the exact route an attacker would take through the code for every confirmed vulnerability.
- Targeted Fix Generation: generate focused code changes tied directly to the confirmed structural flaw, ready for developer review.
- Test-Driven Remediation Skill: write an exploit demo, create a failing security test, implement the fix, verify the exploit is blocked, and cut a reviewable PR.
- Independent Fix Verification: run a separate read-only agent that validates each remediation and emits a per-finding verdict.
- Headless CI/CD Runtime: clone targets, run scans, publish results, and open GitHub issues for confirmed bugs in non-interactive pipelines.
- Batch Scanning: manage multi-repository target lists, resume interrupted runs, monitor progress, and collect findings across all repos.
- Benchmarking Mode: measure scanner accuracy against a known-vulnerable corpus using LLM-judge scoring and generate analytical reports.
What Can VulnHunter Do?
- Scan source code for exploitable vulnerabilities
- Map attacker-accessible entry points in a codebase
- Trace exploit paths through application code
- Verify whether a detected vulnerability is actually exploitable
- Disprove false positive vulnerability findings
- Generate targeted code fixes for confirmed security defects
- Write failing security tests for detected vulnerabilities
- Verify that applied fixes block the original exploit
- Open GitHub issues for confirmed bugs
- Run vulnerability scans across multiple repositories in batch
- Benchmark vulnerability detection accuracy against known-vulnerable codebases
Real-World Applications
Security engineers at mid-to-large companies can use VulnHunter to cut through the false-positive noise that traditional SAST tools generate. Rather than triaging hundreds of flagged patterns, the team receives only confirmed, exploitable findings. Each one comes with an exploit path, a structural explanation, and a proposed fix, so the path from detection to remediation is short.
Development teams shipping web applications or APIs may find the vulnerability scanning software especially useful at pull request time. The /vulnhunter-fix skill writes an exploit demo and a failing security test before touching any code, which gives reviewers a concrete, reproducible proof of the issue and a clean RED-GREEN fix cycle to evaluate.
For organizations running security programs across dozens or hundreds of repositories, the headless runtime agent makes unattended scanning practical. It can clone targets, scan them, and file GitHub issues for confirmed bugs without manual intervention, fitting naturally into a CI/CD pipeline.
Independent developers and open-source maintainers can also run VulnHunter against their own projects before a public release. The benchmarking harness lets them measure detection accuracy against known-vulnerable test codebases and tune their setup before scanning production code.
