How 2696791698/vulnhunter works
VulnHunter is an AI-assisted code-vulnerability auditing tool with a Vue dashboard. The main workflow submits a repository URL and commit (or a function snippet), queues an audit, checks out the target, runs the agent, and presents its verdict. The dashboard also exposes environment checks, trace/span inspection, and token-usage analytics. The README documents MCP integrations and dataset extraction; source excerpts are partial, so uncertain internal call wiring is omitted.
Main entry points: main.py Bridge service · api.ts Dashboard API client · audit_agent.py Audit agent · AuditPage.vue Audit submission
Components 19
Audit workflow
- Repository checkout
web/server/main.py - Audit agent
audit_agent.py - Agent framework
base_agent.py - Model configuration
create_model.py
Dashboard and bridge
- Audit submission
web/src/pages/AuditPage.vue - Task polling
web/src/composables/useAuditTasks.ts - Dashboard API client
web/src/lib/api.ts - Bridge service
web/server/main.py - Audit verdict details
web/src/components/dashboard/AuditTaskSheet.vue - Environment dashboard
web/src/composables/useEnvironment.ts - Environment checks
check_environment.py
Agent observability
- Trace instrumentation
agent_tracing.py - Trace explorer
web/src/composables/useAgentTraces.ts - Token usage
web/src/composables/useTokenUsage.ts
Dataset extraction
- PyVul dataset extraction
extract_pyvul_dataset.py
Other components
- Security engineer
- MCP analysis tools
- Target repository
- PyVul advisories
Connections 18
- Security engineer → Audit submission: submits audit
- Audit submission → Task polling: submits task
- Task polling → Dashboard API client: calls API
- Dashboard API client → Bridge service: HTTP requests
- Bridge service → Repository checkout: queues task
- Repository checkout → Target repository: clones commit
- Repository checkout → Audit agent: starts audit
- Audit agent → Agent framework: uses framework
- Audit agent → Model configuration: creates model
- Audit agent → MCP analysis tools: uses tools
- Bridge service → Audit verdict details: serves task result
- Security engineer → Environment dashboard: requests checks
- Environment dashboard → Dashboard API client: calls API
- Bridge service → Environment checks: runs checks
- Trace instrumentation → Bridge service: posts span events
- Trace explorer → Dashboard API client: requests traces
- Token usage → Dashboard API client: requests usage
- PyVul dataset extraction → PyVul advisories: reads advisories