AgenticVulHunter

AgenticVulHunter is a four-stage secure code review tool. It reviews your current Git changes and reports security issues that pass the validation threshold.

Step 1: Install

Install AgenticVulHunter using:

pipx install agenticvulhunter

Step 2: LLM Setup

You only need:

• Endpoint
• API key
• Model

You can configure them using avh_setup.toml or environment variables.

Option 1: avh_setup.toml

Create avh_setup.toml inside the repository you want to review:

[llm]

endpoint = "http://localhost:11434/v1"
api_key = ""
model = "qwen3-coder:30b"

Option 2: Environment Variables

export AVH_ENDPOINT="http://localhost:11434/v1"
export AVH_API_KEY="your-key"
export AVH_MODEL="qwen3-coder:30b"

Environment variables take priority over avh_setup.toml.

Step 3: Run

Run AgenticVulHunter inside your Git repository:

agenticvulhunter review

The terminal shows live progress for all four review stages plus the bundled BM25 security-rule retrieval. At completion it prints the ranked CWE/rule matches separately from findings that passed validation. BM25 runs locally against the packaged static rule corpus; it does not require another service.

Every accepted finding also includes a repository-verified attack path. Source, propagation, control, and sink citations are checked against the referenced code before the finding is shown. If a citation or path link is inconsistent, the validator automatically sends a focused follow-up prompt; incomplete paths are kept in the run artifacts but are not promoted to findings.

The initial result shows the review and a small suggested code fix. In an interactive terminal, enter a finding number to reveal only its plain-language attack path, or press Enter to finish. Suggested fixes are never applied automatically.

The default validation threshold is 0.6.

To use another threshold:

agenticvulhunter review 0.7