vigolium/vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

What it solves

Vigolium is a high-fidelity vulnerability scanner designed to find security flaws in web applications and codebases. It addresses the need for both fast, deterministic scanning and deep, autonomous AI-driven auditing to reduce manual effort in identifying injection, access control, and framework-specific vulnerabilities.

How it works

The project operates through two primary modes:

  • Native Scan: A deterministic, multi-phase pipeline (discovery, spidering, and audit) using over 300 scanner modules to perform active fuzzing and passive pattern matching. It includes out-of-band testing (OAST) and value-aware mutation of parameters.
  • Agentic Scan: An AI-driven approach powered by the olium runtime. It uses agents to autonomously plan attacks, select modules, generate custom JavaScript attack extensions, and triage results. This mode also integrates source-code auditing via specialized drivers like vigolium-audit and piolium.

Who it’s for

It is built for security researchers, penetration testers, and developers who need to automate the discovery of vulnerabilities in their web APIs, SPAs, and source code.

Highlights

  • Hybrid Scanning: Combines traditional deterministic scanning with autonomous AI agents.
  • Extensive Module Library: Over 320 modules covering the OWASP Top 10.
  • AI-Driven Autopilot: Agents can autonomously discover endpoints and triage findings.
  • Programmable Extensions: An embedded JavaScript engine allows users to write custom scan modules and hooks without recompiling.
  • Multi-Session Auth: Supports complex authentication flows and IDOR/BOLA testing across multiple user sessions.
  • Pluggable AI Providers: Compatible with OpenAI, Anthropic, and Google Vertex AI.

Related

  • Project
    VibiumDev/vibium

    A verification layer for AI coding agents that provides browser automation tools to navigate, interact with, and verify web-based tasks via CLI, MCP, or client libraries.

  • Project
    Kritt-ai/open-kritt

    An open-source security research platform that orchestrates AI agents to find, validate, and rank vulnerabilities in codebases using focused, parallelized workflows.

  • Project
    msoedov/agentic_security

    An open-source vulnerability scanner for LLMs and agent workflows that protects AI systems from jailbreaks, fuzzing, and multimodal attacks.

  • Project
    StanleyNull/AutoHunter

    An autonomous multi-agent system for 24/7 vulnerability discovery that uses LLMs to orchestrate security tools and filters results through an AI reviewer for human approval.

  • Project
    psyray/oasis

    OASIS is a Python CLI tool that uses locally hosted LLMs (via Ollama or any OpenAI‑compatible server) to scan source code for security vulnerabilities. It runs a fast scan model, then deep‑analysis models, validates findings deterministically, caches results, and outputs canonical JSON plus HTML/PDF/Markdown reports. A password‑protected web dashboard lets users explore findings and ask the assistant for re‑investigations. It supports multi‑model runs, suppression registries, diffing against baselines, and CI exit‑code gating.