Vulnetix

Vulnetix AI Coding Agent Plugin

Vulnerability intelligence for AI coding agents — automated dependency scanning, exploit analysis, and remediation powered by the Vulnetix VDB API.

Contents

• Quick Start
• Features
• Prerequisites
• Upgrading
• Troubleshooting
• Privacy & Security
• Full Documentation
• CLI Documentation
• VDB API Reference
• GitHub App

Quick Start

Add the marketplace:

/plugin marketplace add Vulnetix/pix-ai-coding-assistant

Install the plugin:

/plugin install vulnetix@vulnetix-plugins

Verify with /plugins and /hooks.

Features

Skills

Skill	Purpose
/vulnetix:get-api-key [email]	Self-serve a free Community API key (registers + stores credentials)
/vulnetix:package-search <name>	Search packages and assess risk before adding dependencies
/vulnetix:exploits <vuln-id>	Analyze exploit intelligence (PoCs, EPSS, CISA KEV, threat model)
/vulnetix:fix <vuln-id>	Get fix intelligence and apply concrete remediation
/vulnetix:vuln <vuln-id or package>	Look up vulnerability details or list all vulns for a package
/vulnetix:exploits-search [query]	Search for exploits with ecosystem/severity/EPSS filters
/vulnetix:remediation <vuln-id>	Context-aware remediation plan with verification steps

Plus four slash commands for direct VDB CLI access: vdb-vuln, vdb-vulns, vdb-exploits-search, vdb-remediation.

Hooks

Hook	Trigger	Purpose
Pre-commit scan	git commit	Scan staged manifests for vulnerabilities
Manifest edit gate	Edit/Write on manifests	Check packages for vulns before adding
Post-install scan	npm install, pip install, etc.	Auto-scan after dependency changes
Session dashboard	Session start	Show vulnerability status summary
Stop reminder	Session end	Remind about unresolved P1/P2 vulnerabilities
Vuln context inject	User message	Auto-detect CVE/GHSA IDs and inject prior context

Agents

Agent	Purpose
bulk-triage	Triage multiple vulnerabilities in parallel with CWSS priority scoring

Prerequisites

The plugin self-serves both the CLI install and a free API key — you usually don't need to do anything manually. On first use, the ensure-vulnetix-cli.sh hook installs the CLI (brew → scoop → nix → GitHub releases → go install), and if you're unauthenticated it offers a free key.

Install the Vulnetix CLI manually if you prefer:

brew install vulnetix/tap/vulnetix

Get a free API key (optional — self-serve)

Authentication is optional: the VDB serves unauthenticated callers on a shared rate-limited pool. For higher limits, ask the assistant for a key (/vulnetix:get-api-key) or register directly — one unauthenticated request returns working credentials immediately (free Community tier, no email confirmation):

curl -fsS -X POST https://www.vulnetix.com/api/site/v1/register \
  -H 'Content-Type: application/json' -d '{"email":"you@example.com"}'
# → { "orgId": "...", "secret": "...", "apiKey": "...", "jwt": "..." }

vulnetix auth login --org-id <orgId> --secret <secret> --store home

Already have credentials? Run vulnetix auth login (or /vulnetix:auth-login). See CLI Documentation for all installation methods.

Upgrading

Marketplace:

/plugin update vulnetix

Local clone:

cd ~/pix-ai-coding-assistant && git pull

/plugin remove vulnetix

/plugin add ~/pix-ai-coding-assistant/vulnetix

Troubleshooting

Hook not triggering? Run /plugins to check the plugin is enabled, then /hooks to verify registration.

"API unavailable or not authenticated"? Run vulnetix vdb status to check connectivity, then vulnetix auth login if needed.

Skill commands not working? Use the colon syntax: /vulnetix:fix <vuln-id> (not /vulnetix fix).

Scans too slow? The pre-commit hook has a 120s timeout. Stage fewer manifest files or disable temporarily with /plugin disable vulnetix.

Privacy & Security

• No code is sent to Vulnetix — only dependency names and versions
• Manifest files are scanned locally using the Vulnetix CLI
• PoC exploits are never executed — static analysis only
• All API calls are authenticated and use HTTPS

License

Apache-2.0 — see LICENSE for details.

Resources

• Full Plugin Documentation
• Vulnetix CLI Documentation
• VDB API Reference
• GitHub App
• Status Page

Report issues at github.com/Vulnetix/pix-ai-coding-assistant.