vigolium/vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

What Vigolium Is

Vigolium is an open‑source security scanner that can run in two ways:

  • Native Scan – a fast, deterministic, multi‑phase scanner written in Go. It ships with hundreds of built‑in modules that discover content, spider single‑page apps, and test for many vulnerability classes (XSS, SQLi, auth‑bypass, OAST, etc.).
  • Agentic Scan – an AI‑augmented mode that uses an internal “olium” agent framework. The agent plans attacks, selects modules, can generate custom JavaScript extensions, runs a source‑code audit, and triages the findings automatically.

Both modes can be used from the command line, inside a Docker container, or via a REST API server.

Key Capabilities

Area What It Does
Scanning breadth 331 modules (213 active fuzzers, 118 passive pattern matchers) covering OWASP Top 10, cloud/infra, API protocols, and out‑of‑band (OAST) testing.
Discovery Content enumeration (Deparos), Chromium‑driven SPA spider (Spitolas), and multi‑phase pipeline that can be tuned with strategy presets (balanced, deep, etc.).
Auth support Session‑aware authentication via CLI flags, YAML/JSON files, or automated login flows; supports multi‑session testing for IDOR/BOLA.
Extensibility Embedded JavaScript/TypeScript engine lets you write custom modules, hooks, or full‑blown extensions without recompiling.
AI‑driven agent The olium runtime runs “autopilot” (fully autonomous) or “swarm” (master‑agent + specialist agents) modes, choosing modules, generating JS attacks, and running source‑code audits (via vigolium-audit or piolium).
Server / API vigolium server starts a REST API (auth‑key protected) that can ingest traffic, auto‑scan on receipt, and expose an OpenAI‑compatible chat endpoint for programmatic use.
Reporting Generates self‑contained HTML reports; also provides raw JSON/NDJSON output for CI pipelines.
Deployment options Native binary (Linux/macOS/Windows), npm global package, Docker image, or build from source (Go 1.27+, bun 1.3.11+).

Typical Workflow

  1. Install – curl … | bash or npm i -g @vigolium/vigolium.
  2. Run a quick scan – vigolium scan -t https://example.com.
  3. Add auth or custom modules – use --auth, --auth-file, or vigolium ext … to load JS extensions.
  4. Generate a report – vigolium scan … --format html -o report.html.
  5. Optional AI‑enhanced audit – vigolium agent autopilot -t https://example.com --source ./src to let the agent plan attacks and run a source‑code audit.
  6. Serve results – start vigolium server and ingest traffic or use the built‑in UI dashboard.

Who Might Use It

  • Security engineers who need a fast, scriptable scanner that can be integrated into CI/CD pipelines.
  • Red‑team / bug‑bounty hunters looking for an AI‑assisted tool that can automatically generate attack chains and triage findings.
  • DevOps / SRE teams that want to run continuous scans on internal services via the server mode or Docker image.
  • Developers who want to write custom JavaScript extensions to test niche authentication flows.

How to Get Started

  1. Read the quick‑start guide – https://docs.vigolium.com/getting-started/quickstart.
  2. Explore the module list – https://docs.vigolium.com/native-scan/modules-reference.
  3. Try the AI mode – vigolium agent autopilot -t https://target.com (requires an OpenAI‑compatible API key configured via agent.olium.provider).
  4. Run the UI server – VIGOLIUM_API_KEY=secret vigolium server and open the dashboard at the address shown in the console.

License & Community

The core scanner is released under an open‑source license (see the repository’s LICENSE file). Development is coordinated on GitHub, with a Discord community, Twitter, and a sponsor (Daytona) providing sandbox infrastructure. Contributions are welcome via pull requests; see HACKING.md for build instructions.

Related

  • Project
    msoedov/agentic_security

    An open-source vulnerability scanner for LLMs and agent workflows that protects AI systems from jailbreaks, fuzzing, and multimodal attacks.

  • Project
    cloudflare/security-audit-skill

    A coding-agent skill that implements a structured, six-phase security audit workflow to systematically discover and verify vulnerabilities in a codebase.

  • Project
    ZeroDayEvil/ai-security-tool

    AI Security Tool is an open‑source, cross‑platform suite that combines a multi‑protocol terminal (SSH, RDP, VNC, etc.) with AI‑driven security automation. It offers supply‑chain & CVE scanning, LLM‑based command assistance, and a set of 12+ autonomous agents that handle tool selection, recon, attack‑chain building, and fault tolerance. Available as native installers for Windows, macOS, Linux, Android, and as a web UI, it targets red‑teamers, bug‑bounty hunters, and CTF players looking for a unified AI‑native workflow.

  • Project
    xalgorix/xalgorix

    Xalgorix is an open‑source, self‑hosted AI‑driven penetration‑testing platform. An autonomous LLM agent runs a 22‑phase methodology, then a separate verifier re‑exploits each finding, delivering exploit‑verified results. Users bring their own LLM API key, run the tool via binary, Go install, Docker, or source build, and interact through a local web UI or API. Features include a bundled offensive‑security toolset, live telemetry, PDF reports, CI/CD GitHub‑App integration, and optional hosted SaaS. Licensed under Apache 2.0.

  • Project
    ok-helloworld/vibe-pentest

    An AI-powered penetration testing tool that uses a multi-agent architecture to simulate human security experts in discovering vulnerabilities in web apps and APIs.