AgenticVulHunter

AgenticVulHunter is a four-stage agentic secure code review tool. It reviews the current Git change and returns comments that pass the Stage 4 validation threshold.

Pipeline

Git diff
   ↓
Stage 1: Candidate localisation
   ↓
Stage 2: Context enrichment
   ↓
Stage 3: CWE hypothesis generation
   ↓
Stage 4: Vulnerability validation
   ↓
Review comments above the threshold

The pipeline runs directly on the repository. It does not use annotated SCRBench data at runtime.

Install

From this folder:

pipx install . --force

Check the installed version:

agenticvulhunter --version

LLM setup

Only the endpoint and API key are public setup values. The model and research settings stay inside AgenticVulHunter.

Option 1: avh_setup.toml

Create avh_setup.toml in the repository where the review is run:

[llm]
endpoint = "http://localhost:11434/v1"
api_key = ""

For an API endpoint that requires a key:

[llm]
endpoint = "https://example.com/v1"
api_key = "your-key"

Option 2: exports

export AVH_ENDPOINT="http://localhost:11434/v1"
export AVH_API_KEY="your-key"

Exports take priority over avh_setup.toml when both are present.

Do not commit a real API key to Git.

Run a review

Use the default threshold of 0.6:

agenticvulhunter review

Use another threshold:

agenticvulhunter review 0.7

The terminal shows the AVH banner and the status of all four stages while the review is running.

Threshold

The threshold is applied to the final Stage 4 validation score. It is not a separate pipeline stage.

agenticvulhunter review       -> 0.6
agenticvulhunter review 0.7   -> 0.7
agenticvulhunter review 0.9   -> 0.9

JSON output

agenticvulhunter review --json