capitalone/VulnHunter

What it solves

VulnHunter addresses the high rate of false positives common in traditional Static Analysis Security Testing (SAST) tools. Instead of simply flagging suspicious code patterns, it uses an agentic AI approach to determine if a vulnerability is actually exploitable by simulating an attacker's perspective and attempting to disprove its own findings.

How it works

VulnHunter operates as a set of skills for Claude Code, utilizing the reasoning capabilities of Claude Opus. It employs a "forward analysis" model, starting from attacker-accessible entry points (like APIs) and reasoning forward to see if a path to a dangerous sink exists.

It uses a three-part closed-loop process:

1. Hunt: The /vulnhunt skill maps entry points to sinks and runs a multi-stage falsification pipeline to discard unsupported assumptions.
2. Fix: The /vulnhunter-fix skill implements a test-driven remediation process, creating a failing security test (RED), applying a fix (GREEN), and verifying the block.
3. Verify: The /vulnhunt-fix-verify skill acts as an independent, read-only agent that validates whether the fix was successful.

Who it’s for

Security researchers and developers who want to identify and remediate high-priority, actionable security defects in source code with minimal noise.

Highlights

• Attacker-First Analysis: Simulates the actual journey of a bad actor rather than searching backward from sinks.
• Falsification Engine: A structured reasoning workflow designed to actively disprove potential vulnerabilities to reduce false positives.
• Automated Remediation Loop: Integrates hunting, fixing, and independent verification into a single workflow.
• Headless Runtime: Includes a vulnhunter-agent for non-interactive use in CI/CD pipelines and a benchmarking harness for accuracy evaluation.