How future-architect/vuls works
Vuls is an agent-less vulnerability scanner for Linux, FreeBSD, Windows, and macOS. Its main workflow loads target configuration, collects scan data locally, remotely, or through server mode, detects and enriches vulnerabilities, then reports results or presents them in a terminal UI. The architecture also supports library, WordPress, and CPE-based scans, SBOM output, and external notifications. Some scan-command wiring and unsampled subsystems are represented only where documented; dashed edges mark relationships whose implementation was not shown.
Main entry points: detector.go Detection orchestration · scan.go Scan command · server.go HTTP server mode · writer.go Report outputs
Components 22
Entry and configuration
- Vuls CLI
cmd/vuls/main.go - Configuration
config/tomlloader.go
Scanning and inputs
- Scan command
subcmds/scan.go - OS scanners
scanner/base.go - Windows scanning
scanner/windows.go - HTTP server mode
server/server.go
Detection and enrichment
- Scan results
models/scanresults.go - Detection orchestration
detector/detector.go - Vulnerability matching
detector/vuls2/vuls2.go - Vulnerability data
detector/vuls2/vendor.go - CVE content models
models/cvecontents.go - Vulnerability results
models/vulninfos.go - Library scanning
detector/library.go - WordPress scanning
detector/wordpress.go
Results and reporting
- Report command
subcmds/report.go - Report outputs
reporter/writer.go - Slack reports
reporter/slack.go - SBOM generation
reporter/sbom/spdx.go - Terminal viewer
tui/tui.go
Other components
- Administrator
- Target systems
- External services
Connections 24
- Administrator → Vuls CLI: runs
cmd/vuls/main.go - Vuls CLI → Scan command: dispatches
cmd/vuls/main.go - Scan command → Configuration: loads
- Scan command → OS scanners: starts scan
- Target systems → OS scanners: provides system data
- OS scanners → Scan results: collects data
- Scan command → HTTP server mode: supports server mode
- HTTP server mode → OS scanners: parses scan input
server/server.go - HTTP server mode → Detection orchestration: detects packages
server/server.go - HTTP server mode → Vulnerability matching: enriches results
server/server.go - Detection orchestration → Vulnerability matching: detects CVEs
detector/detector.go - Vulnerability matching → Vulnerability data: queries data
- Detection orchestration → Library scanning: checks libraries
- Detection orchestration → WordPress scanning: checks WordPress
detector/detector.go - Detection orchestration → Vulnerability results: assembles findings
- Vulnerability matching → CVE content models: enriches metadata
- Scan results → Detection orchestration: provides scan input
detector/detector.go - Administrator → Report command: requests report
- Report command → Detection orchestration: detects findings
subcmds/report.go - Report command → Report outputs: writes results
- Report outputs → Slack reports: supports Slack
- Report outputs → SBOM generation: generates SBOM
- Vulnerability results → Terminal viewer: displays findings
tui/tui.go - Report outputs → External services: sends notifications