CVE-Guard

Stop AI from writing vulnerable code.

One command. Zero API calls. Works offline.

$ cve-guard scan ./my-project

Built by NOUMENON — AI agents that debate, evolve, and build. Want AI that thinks before it codes? noumenon.ai

Why This Exists

AI-generated code has 1.7x more vulnerabilities than human code. Copilot, Cursor, and Claude don't check if the packages they suggest have known CVEs. cve-guard does.

Run it before you commit. Run it in CI. Sleep better.

Install

pip install cve-guard

Usage

# Scan a project directory
cve-guard scan ./my-project

# Only show critical and high severity
cve-guard scan --severity critical

# Check a single package
cve-guard check react 18.2.0

# JSON output for CI/CD
cve-guard scan --format json

# Show fix commands
cve-guard scan --fix

# View the full CVE database
cve-guard db

Output

  CVE-GUARD — Vulnerability Scanner v1.0.1

  Scanning: ./my-nextjs-app/package.json
  Found: 24 dependencies

  CRITICAL VULNERABILITIES
  Package                   CVE              CVSS  Installed  Fix
  next                      CVE-2025-29927    9.1  15.1.4     >= 15.2.3
  react-server-dom-webpack  CVE-2025-55182   10.0  19.2.0     >= 19.2.1

  MEDIUM VULNERABILITIES
  Package  CVE              CVSS  Installed  Fix
  axios    CVE-2023-45857    6.5  1.4.0      >= 1.6.0

  Summary: 2 critical | 1 medium

  Fix commands:
    npm install next@15.2.3 react-server-dom-webpack@19.2.1 axios@1.6.0

CVEs Currently Detected

Every entry is verified against MITRE and/or the GitHub Advisory Database.

Supported Languages

• JavaScript/Node.js — package.json
• Python — requirements.txt, pyproject.toml
• Ruby — Gemfile
• Go — go.mod
• Rust — Cargo.toml

All five manifest formats are parsed. The bundled database currently has the deepest coverage for JavaScript and Python, plus verified entries for Ruby (rack, nokogiri), Go (golang.org/x/crypto), and Rust (rustls).

CI/CD Integration

GitHub Action

name: CVE Guard
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install cve-guard
      - run: cve-guard scan . --format json --severity high

Pre-commit Hook

repos:
  - repo: https://github.com/noumenon-ai/cve-guard
    rev: v1.0.0
    hooks:
      - id: cve-guard
        name: CVE Guard
        entry: cve-guard scan
        language: python
        pass_filenames: false

Contributing

Found a new CVE? Open a PR to add it to database.py.

License

MIT

Part of the NOUMENON ecosystem. NOUMENON is a multi-agent AI build system where agents debate the best approach before writing a single line of code.

Built by Noumenon