vuln-scout

VulnScout

AI-powered whitebox penetration testing for Claude Code.

One command. Full audit. Any codebase.

/whitebox-pentest:full-audit /path/to/code

---

VulnScout is a Claude Code plugin that turns Claude into an autonomous security reviewer. It brings battle-tested pentesting methodology (HTB Academy, OffSec AWAE/OSWE) into your terminal with STRIDE threat modeling, evidence-first findings, and support for 9 languages including Solidity smart contracts.

Tested end-to-end on OWASP Juice Shop v17.1.1 -- 62 findings across SQL injection, XSS, path traversal, SSTI, SSRF, hardcoded secrets, and more.

Why VulnScout?

Traditional SAST tools find patterns. VulnScout understands your application.

• Automated scan pipeline -- Semgrep + Joern CPG + secret scanning in one command, with SARIF and Markdown output
• Threat models first, then hunts -- STRIDE analysis identifies what matters before scanning
• Traces data flow, not just patterns -- follows user input from source to sink across files and services
• 15 CPG verification scripts -- proves exploitability through Code Property Graph analysis, not just pattern matching
• CVSS 3.1 auto-scoring -- every finding gets a CVSS vector and numeric score
• Handles massive codebases -- language-aware compression (Go: 97% reduction, Python: 90%) lets it audit million-token monorepos
• Chains vulnerabilities -- finds SSRF-to-SSTI-to-RCE attack chains that single-pattern scanners miss
• Polyglot-native -- audits Go + Python + TypeScript microservices as one interconnected system

Quick Start

# Option 1: Symlink into your project's plugin directory
mkdir -p .claude/plugins
ln -s /path/to/vuln-scout/whitebox-pentest .claude/plugins/whitebox-pentest

# Option 2: Copy into your project
cp -r /path/to/vuln-scout/whitebox-pentest .claude/plugins/whitebox-pentest

# Run a full audit
/whitebox-pentest:full-audit .

# Or start with threat modeling
/whitebox-pentest:threats

Note: .claude/plugins/ is relative to your project root. Claude Code automatically discovers plugins in this directory.

Standalone Scan Pipeline

VulnScout includes Python scripts that run independently of Claude Code:

# Scan with Semgrep + secret scanning
python3 scripts/scan_orchestrator.py /path/to/code --tools semgrep --secrets --format sarif

# Create a Joern CPG (cached by content hash)
python3 scripts/create_cpg.py /path/to/code

# Batch-verify findings with Joern CPG analysis
python3 scripts/batch_verify.py --findings .claude/findings.json --cpg .joern/*.cpg

# Render HTML or Markdown from an existing findings artifact
python3 scripts/report.py .claude/findings.json --format html --output security-report.html

# CI gate: fail on high-severity findings
python3 scripts/scan_orchestrator.py . --tools semgrep --fail-on high --format sarif --output findings.sarif

What You Get

13 Commands

Command	What it does
/whitebox-pentest:full-audit	One command does everything -- scopes, threat models, audits, reports
/whitebox-pentest:threats	STRIDE threat modeling with data flow diagrams
/whitebox-pentest:sinks	Find dangerous functions across 9 languages
/whitebox-pentest:trace	Follow data from source to sink
/whitebox-pentest:scan	Run Semgrep, CodeQL, and Joern into a shared findings artifact
/whitebox-pentest:scope	Handle large codebases with smart compression
/whitebox-pentest:propagate	Found one bug? Find every instance of the pattern
/whitebox-pentest:verify	CPG-based false positive elimination
/whitebox-pentest:report	Render Markdown, JSON, SARIF, or HTML from the shared findings artifact
/whitebox-pentest:diff	Compare security posture between git refs and highlight regressions
/whitebox-pentest:auto-fix	Auto-remediate verified findings with generated patches
/whitebox-pentest:create-rule	Generate a custom Semgrep rule from a confirmed vulnerability pattern
/whitebox-pentest:mutate	Mutation-test security controls to find detection gaps

8 Autonomous Agents

Agents run independently and return detailed analysis:

• app-mapper -- Maps architecture and trust boundaries
• threat-modeler -- STRIDE analysis and data flow diagrams (consumes app-mapper output)
• code-reviewer -- Proactive vulnerability identification
• local-tester -- Dynamic testing guidance (hands off to poc-developer)
• poc-developer -- Proof of concept development
• patch-advisor -- Specific remediation with code patches
• false-positive-verifier -- Evidence-based verification with NEEDS_REVIEW resolution path
• attack-researcher -- Autonomous attack vector exploration beyond pattern matching

15 Joern CPG Verification Scripts