VulnLogic CLI

Autonomous AI-powered API penetration testing. 63 attack modules. Zero false positives.

Install

pip install vulnlogic

Quick Start

# Set your Anthropic API key (one time)
vulnlogic config set anthropic-key sk-ant-...

# Run a scan
vulnlogic scan --target myapi --base-url https://api.acme.com --spec openapi.json --token eyJ...

Usage

# Basic scan
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json --token eyJ...

# IDOR testing — provide attacker + victim tokens
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --token eyJ... --victim-token eyJ...

# Run only specific attack groups
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --groups authorization,injection,business_logic

# JSON output
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json --output json

# CI/CD — SARIF output + exit code 1 on high+ findings
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --output sarif --output-file results.sarif --fail-on high

# Against a hosted VulnLogic engine
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --engine-url https://engine.vulnlogic.io

# List all 63 modules
vulnlogic modules

GitHub Actions Example

- name: API Security Scan
  run: |
    pip install vulnlogic
    vulnlogic scan \
      --target ${{ github.repository }} \
      --base-url ${{ secrets.API_URL }} \
      --spec openapi.json \
      --token ${{ secrets.API_TOKEN }} \
      --output sarif \
      --output-file vulnlogic.sarif \
      --fail-on high
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: vulnlogic.sarif

Attack Groups