vigolium — Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision | Kitploit

Other method like Docker or Build from source

Docker

docker pull j3ssie/vigolium:latest
docker run --rm j3ssie/vigolium:latest scan -h

Build from Source

git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build         # build and install to $GOPATH/bin

Requires Go 1.27+ and bun 1.3.11+. See HACKING.md for prerequisites and build details.

# Scan a single target (default: balanced strategy)
vigolium scan -t https://example.com

# Scan with a strategy preset
vigolium scan -t https://example.com --strategy deep

# Scan specific modules only
vigolium scan -t https://example.com -m xss-reflected,sqli-error

# Scan from an OpenAPI spec
vigolium scan -T openapi.yaml -I openapi

# Pipe URLs from stdin
cat urls.txt | vigolium scan

# Run a single phase directly
vigolium run discovery -t https://example.com

# Generate an HTML report
vigolium scan -t https://example.com --only discovery --format html -o report.html

# Start API server with authentication
vigolium server -k my-secret-key

# Enable transparent HTTP proxy for traffic recording
vigolium server -k my-key --ingest-proxy-port 9003

# Auto-scan ingested traffic
vigolium server -k my-key --scan-on-receive

# Inline session via CLI flag (name:Header:value)
vigolium scan -t https://example.com \
  --auth "admin:Cookie:session_id=abc123" \
  --auth "user:Cookie:session_id=xyz789"

# Load session(s) from a YAML/JSON file
vigolium scan -t https://example.com --auth-file ./admin-session.yaml

# Auth file with an automated login flow (token extraction, etc.)
vigolium scan -t https://example.com --auth-file ./login-flow.yaml

# Add custom headers (works with sessions)
vigolium scan -t https://example.com -H "Authorization: Bearer token123"

# Autopilot: autonomous AI-driven scanning (in-process olium engine)
vigolium agent autopilot -t https://example.com
vigolium agent autopilot -t https://example.com --source ./src --prompt "focus on auth bypass"
vigolium agent autopilot -t https://example.com --diff main...feature/auth   # diff-focused
vigolium agent autopilot -t https://example.com --intensity deep             # preset bundle

# Swarm: AI-guided targeted or full-scope vulnerability scanning
vigolium agent swarm -t https://example.com/api/users --vuln-type sqli
vigolium agent swarm -t https://example.com --discover                       # full-scope
vigolium agent swarm -t https://example.com --source ./src --discover        # source-aware full-scope
vigolium agent swarm --input "curl -X POST https://example.com/api/login -d '{\"user\":\"admin\"}'"

# Source-audit drivers (separate harness, do not route through olium)
vigolium agent audit --source ./src                                  # default: auto (audit, fall back to piolium)
vigolium agent audit --source ./src --driver audit --mode deep       # vigolium-audit only (claude/codex)
vigolium agent audit --source ./src --driver piolium --mode balanced # Pi-native (pi extension) only
vigolium agent audit --source ./src --driver both                    # audit then piolium, back-to-back
vigolium agent audit --source ./src --modes deep,confirm             # chain modes (same as --intensity deep)
vigolium agent audit --source ./src -S --output-dir ./audit-out      # throwaway DB + bundled HTML report
vigolium audit --source ./src                                        # top-level alias

# Direct olium access (TUI or headless)
vigolium ol                             # launch the olium TUI
vigolium ol --prompt "..."              # one-shot prompt (-p implies headless)

Layer	Description	Docs
Content Discovery (Deparos)	Adaptive directory/file enumeration with fingerprint-based soft-404 detection	docs.vigolium.com/native-scan/phases/discovery
Browser Spider (Spitolas)	Chromium-driven state-machine crawler with CDP traffic capture	docs.vigolium.com/native-scan/phases/spidering
Audit	Active/passive vulnerability scanning with insertion point extraction and DiffScan framework	docs.vigolium.com/native-scan/phases/audit
Scanner Modules	207 active and 116 passive modules covering OWASP Top 10 and beyond	docs.vigolium.com/native-scan/modules-reference

Topic	Link
Setup Agents	docs.vigolium.com/getting-started/setup-agent
Start a Native Scan	docs.vigolium.com/getting-started/native-scan
Start an Agentic Scan	docs.vigolium.com/getting-started/agentic-scan
Start an Agentic Audit	docs.vigolium.com/getting-started/agentic-security-audit
Quickstart	docs.vigolium.com/getting-started/quickstart
Cheat Sheet	docs.vigolium.com/getting-started/cheat-sheet
Server & Ingestion	docs.vigolium.com/getting-started/server-and-ingestion
Writing Extensions	docs.vigolium.com/customization/writing-extensions

# Execute inline JavaScript
vigolium js --code 'let r = vigolium.http.get(TARGET); console.log(r.status)' -t https://example.com

# Run a JS file with timeout
vigolium js --code-file ./my-script.js -t https://example.com --timeout 60s

# Manage extensions
vigolium ext ls                # list loaded extensions
vigolium ext docs --example    # browse API with code examples
vigolium ext preset            # install starter scripts

// Create a persistent session with shared cookie jar.
// post() takes a string body — serialize objects yourself.
let session = vigolium.http.session();
session.post(
  "https://app.example.com/login",
  JSON.stringify({ user: "admin", pass: "secret" }),
  { headers: { "Content-Type": "application/json" } }
);
session.get("https://app.example.com/dashboard"); // cookies auto-sent

// Automated login flow with token extraction
let authed = vigolium.http.login({
  url: "https://app.example.com/api/auth",
  method: "POST",
  body: JSON.stringify({ username: "admin", password: "pass" }),
  extract: [{ source: "json", path: "$.token", apply_as: "Authorization: Bearer {value}" }]
});

// IDOR/BOLA testing across multiple sessions
let results = vigolium.http.authTest({
  sessions: { admin: adminSession, user: userSession },
  requests: [{ method: "GET", url: "https://app.example.com/api/users/1" }]
});

// Multi-step authentication sequences
let result = vigolium.http.sequence([
  { url: "/csrf", extract: [{ source: "cookie", name: "csrf_token", as: "token" }] },
  { url: "/login", method: "POST", body: "csrf={token}&user=admin" }
]);

// Parallel request batching (race conditions, IDOR)
let responses = vigolium.http.batch([req1, req2, req3], { concurrency: 10 });

// CSRF token extraction
let csrf = vigolium.http.csrf("https://app.example.com/form");

// HTTP request replay with variations
let varied = vigolium.http.replay(rawRequest, [
  { headers: { "Authorization": "Bearer admin_token" } },
  { headers: { "Authorization": "Bearer user_token" } }
]);

Expand the full commands & flags reference

Commands

Scanning:
  vigolium scan                Run a native scan (deterministic multi-phase vulnerability scanning)
  vigolium run <phase>         Run a single native scan phase (alias for scan --only <phase>)
  vigolium scan-url <url>      Quick native scan of a single URL
  vigolium scan-request        Native scan from a raw HTTP request

Agentic scan (in-process olium engine):
  vigolium agent autopilot     Autonomous AI-driven vulnerability scanning
  vigolium agent swarm         AI-guided targeted or full-scope vulnerability scanning
  vigolium agent query         Single-shot prompt (code review, endpoint discovery)
  vigolium agent olium         Direct olium TUI (or one-shot non-interactive via -p)
  vigolium agent audit         Unified driver dispatcher (vigolium-audit and/or piolium, --driver=auto|both|audit|piolium)
  vigolium agent session       Browse/replay agent session artifacts
  vigolium olium | vigolium ol Top-level alias for `vigolium agent olium`

Server & ingestion:
  vigolium server              Start the API server with traffic ingestion
  vigolium ingest              Ingest traffic to a running server
  vigolium storage             Interact with cloud object storage (uploads, downloads)

Data & projects:
  vigolium db                  Database operations (list, stats, export, clean, seed)
  vigolium finding             Browse and manage findings (load, tui)
  vigolium traffic             Browse and replay HTTP records (tui, replay)
  vigolium replay              Mutate a stored/supplied HTTP request and diff baseline vs replay
  vigolium project             Manage projects (create, list, use, config)
  vigolium scope               Manage scope rules
  vigolium import              Import findings/data from external sources
  vigolium export              Export scan results

Extensions & auth:
  vigolium js                  Execute JavaScript/TypeScript code
  vigolium ext                 Manage JavaScript extensions (eval, lint)
  vigolium auth                Manage authentication sessions (list, load, lint, totp)

Setup & introspection:
  vigolium init                Initialize a Vigolium workspace
  vigolium config              Manage configuration (ls, set, path, clean)
  vigolium strategy            Inspect scanning strategies and phases
  vigolium module              Inspect/enable scanner modules
  vigolium doctor              Diagnose environment & dependencies
  vigolium version             Show version info

Flags

Native Scan (vigolium scan / run):
  -t, --target           Target URL
  -T, --target-file      File containing target URLs
  -i, --input            Input file path (- for stdin)
  -I, --input-mode       Input format: urls, openapi, swagger, burp, curl, nuclei, har
  -m, --modules          Modules to run (comma-separated or 'all')
      --strategy         Strategy preset: lite, balanced, deep
      --scanning-profile Scanning profile name or YAML path
      --only             Phases to run (comma-separated): ingestion, discovery (deparos),
                         external-harvest, spidering (spitolas), known-issue-scan,
                         dynamic-assessment, extension
      --skip             Phases to skip (repeatable, same names as --only)
  -S, --stateless        Use a throwaway temp database, discarded after the scan
      --fail-on          Exit non-zero when a finding at/above this severity is present

Authentication:
      --auth              Inline session definition (name:Header:value, repeatable)
      --auth-file         Session YAML/JSON file path, supports login flows (repeatable)
  -H, --header           Custom HTTP header (repeatable)

Performance:
  -c, --concurrency      Concurrent workers (default: 50)
  -r, --rate-limit       Max requests/sec (default: 0 = unlimited)
      --max-per-host     Per-host concurrency cap (default: 2)
      --proxy            HTTP/SOCKS5 proxy URL
      --timeout          HTTP request timeout (default: 15s)

Agentic Scan (vigolium agent autopilot / swarm / query):
      --source             Path to source code for source-aware scanning
      --files              Specific files to include relative to --source
      --source-label       Label for source code ingestion
      --provider           Olium provider: openai-compatible (default), openai-codex-oauth,
                           openai-api-key, openai-responses, anthropic-api-key,
                           anthropic-oauth, anthropic-cli, anthropic-compatible,
                           anthropic-claude-sdk-bridge, anthropic-vertex, google-vertex
      --model              Model ID override
      --oauth-token        OAuth bearer token (anthropic-oauth)
      --oauth-cred         OAuth/SA file path (openai-codex-oauth, anthropic-vertex,
                           google-vertex)
      --llm-api-key        API key (anthropic-api-key, openai-api-key)
      --vuln-type          Vulnerability type focus (sqli, xss, ssrf, ...)
      --prompt             Free-text task guidance (same as the positional [prompt])
      --plan-file          Plan file mixing guidance + raw seed HTTP request(s)
      --knowledge-base     File/dir describing the app; prose is distilled, traffic
                           exports (HAR/Burp/curl/OpenAPI/Postman) are ingested
      --prior-context      Front-load existing project traffic/findings: auto, summary, off
      --intensity          Preset bundle: quick, balanced, deep
      --diff               Diff range / PR URL / HEAD~N for change-focused scans
      --last-commits       Shorthand for --diff HEAD~N
      --code-audit         Enable AI code audit (default: on with --source)
      --discover           Run discovery+spidering before planning (swarm)
      --audit              vigolium-audit mode: lite, balanced, deep, mock, off
      --piolium            Piolium audit mode (empty = auto-pick)
      --resume             Resume a durable-autopilot run by agentic-scan UUID
      --session-dir        Pin the session dir for this run's debug artifacts
      --transcript         Copy transcript.jsonl out after the run
      --max-iterations     Max triage-rescan iterations
      --max-commands       Cap on agent tool calls
      --token-budget       Cap on aggregate tokens
      --max-duration       Max agent wall-clock time (0 = no limit)
      --only / --skip / --start-from   Phase control (swarm)

Source audit (vigolium agent audit / vigolium audit):
      --driver             auto (default), both, audit, piolium
      --intensity          Preset: quick, balanced, deep (deep = modes deep,confirm)
      --mode               Mode override: lite, balanced, deep, revisit, confirm, merge, ...
      --modes              Chain modes back-to-back (e.g. deep,confirm)
      --list-modes         Print the audit mode graph and exit
      --agent              Coding agent for the audit leg: claude or codex
      --keep-raw           Keep raw output under <source>/vigolium-results/ (on by default)
      --clean-raw          Remove the source-tree raw copy after the run
  -S, --stateless          Run into a throwaway DB and auto-render an HTML report
      --output-dir         Bundle the HTML report + raw results into one folder (needs -S)
      --no-dedup           Skip the post-pass project-wide findings dedup
      --no-preflight       Skip the pre-audit auth/model roundtrip checks
  -i, --interactive        Drive the audit yourself in the coding agent (audit driver only)

JavaScript:
      --code             Inline JavaScript to execute
      --code-file        Path to JS/TS file to execute
      --timeout          Execution timeout (default: 30s)

Output:
  -j, --json             Compact, token-aware JSON output (read/query commands)
      --format           Output format (comma-separated for multiple): console, jsonl,
                         html, sqlite (needs -S), fs (flat traffic/finding tree)
  -o, --output           Output file path
      --silent           Suppress all output except findings
  -v, --verbose          Verbose logging

make build          # build and install
make test           # run all tests (auto-installs gotestsum)
make test-unit      # fast unit tests (-short, no external deps)
make test-e2e       # E2E tests (requires Docker)
make lint           # run linter
make fmt            # format code

vigolium

Most Popular

Installation

Quick Install (Recommended)

npm

Windows

Docker

Build from Source

Key Features

Native Scan

Agentic Scan

Quick Start: Native Scan

Server Mode

Authenticated Scanning

Agentic Scan

⚡ Vigolium Cloud Console

Native Scan Layers

Documentation

JavaScript Engine

CLI Reference

Commands

Flags

Repository Layout

Benchmarks

Development

Security

License

vigolium

Most Popular

Installation

Quick Install (Recommended)

npm

Windows

Docker

Build from Source

Sponsor

Key Features

Native Scan

Agentic Scan

Quick Start: Native Scan

Server Mode

Authenticated Scanning

Agentic Scan

⚡ Vigolium Cloud Console

Native Scan Layers

Documentation

JavaScript Engine

CLI Reference

Commands

Flags

Repository Layout

Benchmarks

Development

Security

License