cve-coder

Agentic CVE triage pipeline: detect → patch → verify.

Given a CVE identifier, a coding agent (Claude) reads the vulnerable checkout, judges whether the vulnerability is present, applies a fix, and writes a regression test that fails on the buggy commit and passes after the fix — all without CodeQL, ChromaDB, or any language server.

Quick start

# From PyPI (once published)
pip install cve-coder
cp .env.example .env   # fill in ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN
cvecoder -h

# From source
git clone https://github.com/digital-duck/cve-coder
cd cve-coder
python3 -m venv .venv && source .venv/bin/activate
pip install -e .
cp .env.example .env
cvecoder -h

Run a CVE

# Full pipeline (spec + detect + patch + verify)
cvecoder pipeline --cve-id CVE-2025-66455 --agent claude_cli --model sonnet-5

# With feedback loop (up to 3 patch→verify rounds)
cvecoder pipeline --cve-id CVE-2025-66455 --agent claude_cli --model sonnet-5 --max-iters 3

# Individual stages
cvecoder spec   --cve-id CVE-2025-66455
cvecoder detect --in output/triage/CVE-2025-66455/cve-1-metadata.yaml --agent claude_cli
cvecoder patch  --in output/triage/CVE-2025-66455/cve-2-findings.yaml --agent claude_cli
cvecoder verify --in output/triage/CVE-2025-66455/cve-3-fixes.yaml   --agent claude_cli

# CVE not in the bundled CSV — supply repo/commit directly
cvecoder pipeline --cve-id CVE-XXXX-XXXXX \
    --github-url https://github.com/owner/repo --commit <sha> \
    --agent claude_cli --model sonnet-5

Output

output/triage/<CVE-ID>/
├── cve-1-metadata.yaml   # NVD description, CWE, CVSS, repo/commit
├── cve-2-findings.yaml   # agent verdict + file/line evidence
├── cve-3-fixes.yaml      # fix strategy + git diff
├── cve-4-tests.yaml      # regression test + PASS/FAIL on both checkouts
└── cve-5-pipeline.yaml   # per-stage summary + overall_status

Adding CVEs

Edit data/project_info-py.csv (Python), data/project_info-js.csv (JS), or data/project_info.csv (Java) with the CVE's GitHub repo, buggy commit, and fix commit. Then run cvecoder spec --cve-id <CVE-ID> to clone and check out the repo.

Model aliases

Architecture

cve_coder/
├── cve_coder.py     # Click CLI entry point (spec/detect/patch/verify/pipeline)
├── cve_spec.py      # Stage 0: NVD fetch + repo checkout
├── cve_detect.py    # Stage 1: agent reads code, judges vulnerability
├── cve_patch.py     # Stage 2: agent fixes the code
├── cve_verify.py    # Stage 3: agent writes + runs regression test
├── triage_common.py # Shared helpers (agent invocation, YAML I/O, skills)
├── nvd_client.py    # NVD API fetch + parse (no ChromaDB)
└── get_cve_repos.py # Clone repo at buggy commit (used by spec stage)

skills/detect/
├── common/SKILL.md  # Detect-stage skill loaded for all languages
└── python/SKILL.md  # Python-specific detect skill

data/
├── project_info.csv     # Java CVEs (GitHub repo + commit info)
├── project_info-py.csv  # Python CVEs
└── project_info-js.csv  # JavaScript CVEs

No CodeQL, no ChromaDB, no language server required.