VulnHunter is an agentic AI security tool designed for proactive, attacker-first source code analysis. It addresses the limitations of traditional SAST tools by identifying genuinely exploitable vulnerabilities, mapping attack paths, and providing evidence-backed fixes, benefiting engineers and security professionals seeking actionable insights into code security.

How It Works

VulnHunter employs an "attacker-first" forward analysis approach, simulating an adversary's journey from entry points to potential exploits, contrasting with traditional "sink-first" methods. A core "Falsification Engine" rigorously attempts to disprove identified vulnerabilities, ensuring only high-priority, actionable defects reach the user. The system operates via three composable Claude Code skills: /vulnhunt for discovery, /vulnhunter-fix for developer-led remediation, and /vulnhunt-fix-verify for independent validation, forming a closed-loop hunt-fix-verify process.

Quick Start & Requirements

• Primary install: Clone the repository (git clone https://github.com/capitalone/vulnhunter.git), cd vulnhunter, and run ./install.sh to copy skills into ~/.claude/skills/.
• Prerequisites: Claude Code CLI authenticated with access to Claude Opus. Python 3.12+ is required for the runtime agent and benchmarking harness. The fixer requires git and an authenticated GitHub CLI (gh).
• Links:
  • Repository: https://github.com/capitalone/vulnhunter.git
  • Fixer README: vulnhunter-fix/README.md
  • Agent README: vulnhunter-agent/README.md
  • Harness README: harness/README.md

Highlighted Details

• Automated Remediation Loop: Comprises three distinct Claude Code skills: /vulnhunt (hunt), /vulnhunter-fix (fix), and /vulnhunt-fix-verify (verify).
• Scalability: Features a headless runtime agent (vulnhunter-agent/) for CI/CD integration and a local harness (harness/) for batch scanning and benchmarking.
• Falsification Engine: A structured reasoning workflow designed to disprove potential vulnerabilities, significantly reducing false positives.
• Evidence-Backed Remediation: Generates detailed exploit paths, explains attacker capabilities, and proposes targeted code changes.

Maintenance & Community

Developed internally at Capital One, VulnHunter is released to the community. Specific community channels like Discord or Slack are not detailed in the README.

Licensing & Compatibility

Distributed under the terms of the Apache License, Version 2.0. This license is generally permissive for commercial use and integration into closed-source projects.

Limitations & Caveats

The tool is built and optimized for Claude Opus, requiring frontier-class LLM reasoning capabilities. Running VulnHunter on Anthropic's platforms necessitates enrollment in their Cyber Verification Program to avoid potential blocking by real-time safeguards. Users must ensure they have explicit authorization before scanning any codebase.