AutoCVE Security Audit Platform
Automates the path from project selection and source review to vulnerability verification and CVE-ready reporting.
- Source repo
- larlarua/AutoCVE
- Stars
- ★ 1.2k
- Last updated
- 2mo ago
- License
- AGPL-3.0
- Primary language
- Python
- FA score
- 44/100 · Major gaps
At a glance
- How it runs
- Works with
- Portable with changes
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An authorized security researcher wants an end-to-end CVE research workflow for an imported open-source project, including an audit trail and report output.
- Not a fit if
- Anyone without explicit authorization to scan or test targets
- Users who expect the tool to submit CVEs for them
- Source review
- 44/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
AutoCVE is a self-hosted platform for authorized security research and source-code auditing, covering project selection, repository import, audit creation, vulnerability verification, and report generation. An Orchestrator coordinates Recon, Scan, Triage, Finding, and Verification agents, then merges and finalizes the audit output. It offers Enhanced Scan, Intelligent Audit, and Comprehensive Audit modes for scan-result filtering, deeper vulnerability research, or both together. The deployment exposes a React frontend, a FastAPI backend, PostgreSQL, and Adminer. Findings can be deduplicated and stored structurally, while generated CVE application reports must still be copied and submitted by the user through the target project's disclosure process.
A user imports a project and creates an audit task. The Orchestrator then coordinates Recon, Scan, Triage, Finding, and Verification: Recon collects information, Scan invokes scanning tools, Triage filters false positives, Finding analyzes source code directly, and Verification performs dynamic validation before Merge / Finalize consolidates the result. The Finding Agent uses a ReAct Loop, specialized tool calls, Nudge correction, and the FinalizeFinding structured termination mechanism. The UI shows activity logs, the Agent Tree, tool calls, stage progress, preliminary reports, and audit sessions; users can continue the conversation to request evidence, attack-chain explanations, or reproduction details. Deduplicated findings are saved in structured form and can be edited or exported as reports for a subsequent CVE submission.
- An authorized security researcher wants an end-to-end CVE research workflow for an imported open-source project, including an audit trail and report output.
- A security team has scanner output and wants to use Enhanced Scan with Scan → Triage to reduce false positives.
- A vulnerability researcher needs direct source analysis for potentially high-value findings and chooses the Finding-centered Intelligent Audit mode.
- A code-audit team wants to combine tool-assisted scanning with source analysis in one task through Comprehensive Audit.
- A disclosure owner needs deduplicated vulnerability records and a report that can be copied into a CVE submission process.
How do you install or deploy this agent?
On Linux, macOS, or Git Bash, run:
curl -fsSL https://raw.githubusercontent.com/larlarua/AutoCVE/v1.0.5/docker-compose.prod.yml | docker compose -f - up -dOn Windows PowerShell or CMD, run:
curl.exe -fsSL https://raw.githubusercontent.com/larlarua/AutoCVE/v1.0.5/docker-compose.prod.yml | docker compose -f - up -dFor a source deployment:
git clone https://github.com/larlarua/AutoCVE.git
cd AutoCVE
docker compose up -d --buildOpen http://localhost:3000 after startup. A model must be configured before auditing; the supplied material does not document supported providers, credential fields, or the configuration procedure.
How do you use this agent?
Open http://localhost:3000, configure a model in the product, import a project, and create an audit task. Select Enhanced Scan, Intelligent Audit, or Comprehensive Audit for the audit goal, then follow activity logs, the Agent Tree, tool calls, and stage progress. When the task finishes, review deduplicated structured findings in vulnerability management and edit or export the report. To apply for a CVE, copy the generated report and submit it yourself through the target project's SECURITY.md, GitHub Private Vulnerability Reporting, CNA process, or another responsible-disclosure route.
What are this agent's strengths and limitations?
- Connects project selection, repository import, auditing, verification, and report generation in one defined workflow.
- Uses an Orchestrator to divide work among Recon, Scan, Triage, Finding, and Verification, combining scan-result filtering with source-led investigation.
- The Finding Agent explicitly uses a ReAct Loop, Nudge, and FinalizeFinding for audit control and structured completion.
- Provides activity logs, an Agent Tree, tool-call visibility, and session tracking for audit review and evidence follow-up.
- The material says a model must be configured but does not identify supported providers, required credentials, costs, or behavior when a model fails.
- Generating a CVE report is not CVE submission; the user remains responsible for submission and for following the target's disclosure policy.
- The project is restricted to explicitly authorized research, auditing, scanning, verification, and PoC testing; it is not for unauthorized target assessment.
- The supplied material does not document API authentication, model setup, repository-import mechanics, or production operations, leaving important adoption details unresolved.
How does this agent compare with similar options?
The README identifies DeepAudit as an engineering-architecture reference during early development, but supplies no feature comparison, benchmark, or migration guidance.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AutoCVE Security Audit Platform This agent | 44 · Major gaps | Self-hosted serviceFree + model costs | ★ 1.2k | 2mo ago | Python | — |
| Self-hosted AI Starter Kit | 50 · Major gaps | Self-hosted serviceFree | ★ 15k | 3mo ago | — | — |
| AgenticOS Team Agent Workspace | 68 · Some gaps | Self-hosted serviceFree + model costs | ★ 221 | today | Python | OpenAI API · Claude API |
| Nasiko Agent Control Plane | 39 · Major gaps | Self-hosted serviceFree + model costs | ★ 12k | 14d ago | Rust | OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence: README mentions permission protection (architecture doc), but no implementation details; user interaction exists (interactive audit), but confirmation mechanism not explicit; data flow transparency limited, only tool call tracking mentioned; sensitive data handling not detailed; dependency security not mentioned; external effects (scan targets) have safety warnings, but sandbox details absent; rollback not mentioned; source attribution acknowledges DeepAudit, but full dependency sources not provided. Deductions: most criteria only surface-level mentions without concrete implementation evidence.
Evidence: README and test files describe a consistent Multi-Agent flow, good self-consistency; dependency availability not explicitly stated, but Docker deployment provided; failure messages not detailed. Deductions: lack of concrete evidence for dependency availability and failure messages.
Evidence: README identifies target users (security researchers) and multiple audit modes for different scenarios; capability boundaries defined via three modes; trigger precision not explicit; environment fit via Docker and source deployment. Deductions: trigger precision and some environment details insufficient.
Evidence: README provides doc links (user guide, architecture, API), clear information architecture; install notes detailed (one-line and source); naming stability not explicit; examples and FAQ have CVE results but no FAQ; known limitations not explicit; license AGPL-3.0 complete; versioning via release workflow generates changelog; maintenance responsibility has contact info. Deductions: naming stability, known limitations, and FAQ missing.
Evidence: Output is CVE report with clear format; high marginal value (automated CVE discovery); cost-benefit not detailed, but one-line deployment provided. Deductions: cost-benefit lacks concrete data.
Evidence: README claims 30 CVEs found, but no verification method; cross-source corroboration via CVE links, but not independently verified; facts and inferences not clearly separated. Deductions: lack of verifiable test results and independent verification.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- The repository claims 30 CVEs found, but no reproducible verification method is provided; treat with caution.
- Security mechanisms like permission protection and sandbox isolation are only mentioned in docs, without implementation details; actual security unknown.
- Dependency security not mentioned; there may be dependencies with known vulnerabilities.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.0.5 Release v1.0.5
Release notes excerpt
自 v1.0.4 以来的变更： - Merge pull request #33 from larlarua/dev/context-compaction (dce556c) - chore(release): prepare v1.0.5 (5f7c257) - Merge PR #26 with current runtime architecture (26b9e64) - feat: support resuming audits after interruption (4d272e6) - feat: update model provider support (4ef85c6) - 修复 #27/#19：FinalizeFinding 缺失时允许尝试 finalizer continuation (5bae89e) - 修复：Opus 4.8 不支持 temperature 参数及 assistant prefill 的兼容性问题 (51509af) - 修复：运行时会话未返回可解析 payload 时抛出错误的问题 (4dec116) - feat: support paginated GitHub branch listing; fix branch selector width (5265c3f) 🚀 AutoCVE 发布亮点 …View on GitHub ↗ -
v1.0.4 Release v1.0.4
Release notes excerpt
自 v1.0.3 以来的变更： - fix: persist uploaded ZIP project sources for worker audits (97ce141) - docs: update acknowledgements in README (f1b96c2) - docs: update architecture design (bfff54f) 🚀 AutoCVE 发布亮点 - 一键 CVE 挖掘: 支持项目筛选、仓库导入、审计任务创建和候选漏洞跟踪 - Multi-Agent 审计流程: 通过 Orchestrator 调度 Recon、Scan、Triage、Finding、Verification 等 Agent - Finding Agent 深度挖掘: 基于 ReAct loop、工具编排、nudge 纠偏和结构化终止工具产出漏洞证据 - 漏洞报告管理: 支持中文报告、English Report 和 CVE 报告生成与维护 - 一行命令部署: 提供基于 GHCR 预构建镜像的 Docker Compose 生产部署方式 📦 下载说明 构建产物 - autocve-frontend-*.tar.gz: 前端构建产物（用于生产部署） …View on GitHub ↗ -
v1.0.3 Release v1.0.3
Release notes excerpt
自 v1.0.0 以来的变更： - 修复停止一键 CVE 后，当前正在执行的单个扫描任务不会同步停止的问题。 - 一键 CVE 启动前增加模型连通性预检查，模型配置不可用时会提前提示。 - 模型配置新增 Temperature 参数，避免部分模型请求因缺少 temperature 失败。 - 优化 Agent 事件队列：限制队列大小、降低 token 事件压力，避免长任务导致后端无响应。 - 新增 Agent Worker / One-click CVE Worker 执行模式，并在 Docker Compose 中增加资源限制，降低单个任务拖垮后端 API 的风险。 - 一键 CVE 增加仓库大小限制，避免拉取过大的仓库导致资源耗尽。 - 一键 CVE 调整为默认仅启用 Recon 和 Finding Agent。 🚀 AutoCVE 发布亮点 - 一键 CVE 挖掘: 实现从项目筛选、仓库导入、审计任务创建、Agent 漏洞挖掘到 CVE 申报报告生成的全流程自动化 - Multi-Agent 审计流程: 通过 Orchestrator 调度 Recon、Scan、Triage、Finding、Verification 等 Agent …View on GitHub ↗
FAQ
Does it submit CVEs automatically?
Which model credentials are required?
Can it scan any internet target?
What local endpoints are available after deployment?
http://localhost:3000, the backend API at http://localhost:8000, Swagger at http://localhost:8000/docs, and Adminer at http://localhost:8080.