VulnHunter is an open-source Python-based agentic AI security tool from Capital One that performs attacker-first analysis on code, with three Claude Code skills for hunting, fixing, and verifying fixes. It includes installation scripts, usage commands, and batch/harness tooling.
What it is
VulnHunter is an open-source, agentic AI security tool that applies proactive, attacker-first analysis directly to source code. It aims to identify exploitable defects, map prospective attack paths, and generate targeted fixes. The project is organized as three Claude Code skills that form a remediation loop: /vulnhunt (Hunt), /vulnhunter-fix (Fix), and /vulnhunt-fix-verify (Verify).
How it works
The workflow consists of:
- Attacker-first forward analysis starting from entry points to dangerous sinks, with a multi-stage falsification pipeline.
- Falsification engine to disprove its own argument and discard unsupported findings.
- Evidence-backed remediation that maps exact exploit paths and generates focused code changes for review.
- Three composable skills:
/vulnhunt,/vulnhunter-fix,/vulnhunt-fix-verify, plus a headless runtime (vulnhunter-agent/) and batch harness (harness/).
Getting started
Installation steps:
# Clone the repository
git clone https://github.com/capitalone/vulnhunter.git
cd vulnhunter
# Copy skills into ~/.claude/skills/
./install.sh
# (Optional) To clean up or remove installed skills
# ./uninstall.sh
Usage commands:
claude --model opus --add-dir ~/.claude/skills/vulnhunt --add-dir ~/.claude/skills/vulnhunt/phases
# Inside the Claude Code session, invoke:
/vulnhunt
claude --model opus --add-dir ~/.claude/skills/vulnhunter-fix
# Inside the Claude Code session, invoke:
/vulnhunter-fix
Verifier usage:
claude --model opus --add-dir ~/.claude/skills/vulnhunt-fix-verify \
--add-dir ~/.claude/skills/vulnhunt-fix-verify/phases
# Inside the Claude Code session, invoke:
/vulnhunt-fix-verify repo=<abs_path> report=<abs_path> fixed=VULN-001,... out=<abs_path> [comments=<abs_path>] [additional_repos=<path1>,<path2>]
Automation & scale: headless runtime agent and harness for batch scans are provided under vulnhunter-agent/ and harness/ respectively.
Recent releases
Latest release: v0.1.0 Initial Launch (2026-07-18). It announces open-source VulnHunter and the initial contribution.
Traction
GitHub stats: 772 stars, 106 forks, 10 open issues.
License
Apache-2.0
Getting started details
Prerequisites include Claude Code CLI with Claude Opus access, and Python 3.12+ for runtime and harness components. Installation copies files rather than symlinks to avoid issues with subagents.
Caveats
License: Apache-2.0. Prerequisites require Claude Opus/Claude Code and model access. The README includes a cyber-safeguard disclaimer about dual-use capabilities and potential platform constraints.