# future-architect/vuls architecture

> Architecture diagram of the GitHub repository future-architect/vuls, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/future-architect/vuls
- Repository: https://github.com/future-architect/vuls

## Overview

Vuls is an agent-less vulnerability scanner for Linux, FreeBSD, Windows, and macOS. Its main workflow loads target configuration, collects scan data locally, remotely, or through server mode, detects and enriches vulnerabilities, then reports results or presents them in a terminal UI. The architecture also supports library, WordPress, and CPE-based scans, SBOM output, and external notifications. Some scan-command wiring and unsampled subsystems are represented only where documented; dashed edges mark relationships whose implementation was not shown.

Main entry points: [`detector/detector.go`](https://github.com/future-architect/vuls/blob/master/detector/detector.go) (Detection orchestration), [`subcmds/scan.go`](https://github.com/future-architect/vuls/blob/master/subcmds/scan.go) (Scan command), [`server/server.go`](https://github.com/future-architect/vuls/blob/master/server/server.go) (HTTP server mode), [`reporter/writer.go`](https://github.com/future-architect/vuls/blob/master/reporter/writer.go) (Report outputs)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Entry and configuration"]
  node_cli["Vuls CLI<br/>[main.go]"]
  node_config["Configuration<br/>[tomlloader.go]"]
end

subgraph group_scan["Scanning and inputs"]
  node_scan_cmd["Scan command<br/>[scan.go]"]
  node_scanner["OS scanners<br/>[base.go]"]
  node_windows["Windows scanning<br/>[windows.go]"]
  node_server["HTTP server mode<br/>[server.go]"]
end

subgraph group_detect["Detection and enrichment"]
  node_scan_results["Scan results<br/>[scanresults.go]"]
  node_detector["Detection orchestration<br/>[detector.go]"]
  node_vuls2["Vulnerability matching<br/>[vuls2.go]"]
  node_vendor_data[("Vulnerability data<br/>[vendor.go]")]
  node_cve_content["CVE content models<br/>[cvecontents.go]"]
  node_vuln_info["Vulnerability results<br/>[vulninfos.go]"]
  node_libraries["Library scanning<br/>[library.go]"]
  node_wordpress["WordPress scanning<br/>[wordpress.go]"]
end

subgraph group_output["Results and reporting"]
  node_report_cmd["Report command<br/>[report.go]"]
  node_reporters["Report outputs<br/>[writer.go]"]
  node_slack["Slack reports<br/>[slack.go]"]
  node_sbom["SBOM generation<br/>[spdx.go]"]
  node_tui["Terminal viewer<br/>[tui.go]"]
end

node_admin(("Administrator"))
node_target(("Target systems"))
node_external_services(("External services"))

node_admin -->|"runs"| node_cli
node_cli -->|"dispatches"| node_scan_cmd
node_scan_cmd -.->|"loads"| node_config
node_scan_cmd -.->|"starts scan"| node_scanner
node_target -.->|"provides system data"| node_scanner
node_scanner -.->|"collects data"| node_scan_results
node_scan_cmd -.->|"supports server mode"| node_server
node_server -->|"parses scan input"| node_scanner
node_server -->|"detects packages"| node_detector
node_server -->|"enriches results"| node_vuls2
node_detector -->|"detects CVEs"| node_vuls2
node_vuls2 -.->|"queries data"| node_vendor_data
node_detector -.->|"checks libraries"| node_libraries
node_detector -->|"checks WordPress"| node_wordpress
node_detector -.->|"assembles findings"| node_vuln_info
node_vuls2 -.->|"enriches metadata"| node_cve_content
node_scan_results -->|"provides scan input"| node_detector
node_admin -.->|"requests report"| node_report_cmd
node_report_cmd -->|"detects findings"| node_detector
node_report_cmd -.->|"writes results"| node_reporters
node_reporters -.->|"supports Slack"| node_slack
node_reporters -.->|"generates SBOM"| node_sbom
node_vuln_info -->|"displays findings"| node_tui
node_reporters -.->|"sends notifications"| node_external_services

click node_cli "https://github.com/future-architect/vuls/blob/master/cmd/vuls/main.go"
click node_config "https://github.com/future-architect/vuls/blob/master/config/tomlloader.go"
click node_scan_cmd "https://github.com/future-architect/vuls/blob/master/subcmds/scan.go"
click node_scanner "https://github.com/future-architect/vuls/blob/master/scanner/base.go"
click node_windows "https://github.com/future-architect/vuls/blob/master/scanner/windows.go"
click node_server "https://github.com/future-architect/vuls/blob/master/server/server.go"
click node_scan_results "https://github.com/future-architect/vuls/blob/master/models/scanresults.go"
click node_detector "https://github.com/future-architect/vuls/blob/master/detector/detector.go"
click node_vuls2 "https://github.com/future-architect/vuls/blob/master/detector/vuls2/vuls2.go"
click node_vendor_data "https://github.com/future-architect/vuls/blob/master/detector/vuls2/vendor.go"
click node_cve_content "https://github.com/future-architect/vuls/blob/master/models/cvecontents.go"
click node_vuln_info "https://github.com/future-architect/vuls/blob/master/models/vulninfos.go"
click node_libraries "https://github.com/future-architect/vuls/blob/master/detector/library.go"
click node_wordpress "https://github.com/future-architect/vuls/blob/master/detector/wordpress.go"
click node_report_cmd "https://github.com/future-architect/vuls/blob/master/subcmds/report.go"
click node_reporters "https://github.com/future-architect/vuls/blob/master/reporter/writer.go"
click node_slack "https://github.com/future-architect/vuls/blob/master/reporter/slack.go"
click node_sbom "https://github.com/future-architect/vuls/blob/master/reporter/sbom/spdx.go"
click node_tui "https://github.com/future-architect/vuls/blob/master/tui/tui.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_config toneBlue
class node_scan_cmd,node_scanner,node_windows,node_server toneAmber
class node_scan_results,node_detector,node_vuls2,node_vendor_data,node_cve_content,node_vuln_info,node_libraries,node_wordpress toneMint
class node_report_cmd,node_reporters,node_slack,node_sbom,node_tui toneRose
class node_admin,node_target,node_external_services toneIndigo
```

## Components

### Entry and configuration

- [Vuls CLI](https://github.com/future-architect/vuls/blob/master/cmd/vuls/main.go): `cmd/vuls/main.go`
- [Configuration](https://github.com/future-architect/vuls/blob/master/config/tomlloader.go): `config/tomlloader.go`

### Scanning and inputs

- [Scan command](https://github.com/future-architect/vuls/blob/master/subcmds/scan.go): `subcmds/scan.go`
- [OS scanners](https://github.com/future-architect/vuls/blob/master/scanner/base.go): `scanner/base.go`
- [Windows scanning](https://github.com/future-architect/vuls/blob/master/scanner/windows.go): `scanner/windows.go`
- [HTTP server mode](https://github.com/future-architect/vuls/blob/master/server/server.go): `server/server.go`

### Detection and enrichment

- [Scan results](https://github.com/future-architect/vuls/blob/master/models/scanresults.go): `models/scanresults.go`
- [Detection orchestration](https://github.com/future-architect/vuls/blob/master/detector/detector.go): `detector/detector.go`
- [Vulnerability matching](https://github.com/future-architect/vuls/blob/master/detector/vuls2/vuls2.go): `detector/vuls2/vuls2.go`
- [Vulnerability data](https://github.com/future-architect/vuls/blob/master/detector/vuls2/vendor.go): `detector/vuls2/vendor.go`
- [CVE content models](https://github.com/future-architect/vuls/blob/master/models/cvecontents.go): `models/cvecontents.go`
- [Vulnerability results](https://github.com/future-architect/vuls/blob/master/models/vulninfos.go): `models/vulninfos.go`
- [Library scanning](https://github.com/future-architect/vuls/blob/master/detector/library.go): `detector/library.go`
- [WordPress scanning](https://github.com/future-architect/vuls/blob/master/detector/wordpress.go): `detector/wordpress.go`

### Results and reporting

- [Report command](https://github.com/future-architect/vuls/blob/master/subcmds/report.go): `subcmds/report.go`
- [Report outputs](https://github.com/future-architect/vuls/blob/master/reporter/writer.go): `reporter/writer.go`
- [Slack reports](https://github.com/future-architect/vuls/blob/master/reporter/slack.go): `reporter/slack.go`
- [SBOM generation](https://github.com/future-architect/vuls/blob/master/reporter/sbom/spdx.go): `reporter/sbom/spdx.go`
- [Terminal viewer](https://github.com/future-architect/vuls/blob/master/tui/tui.go): `tui/tui.go`

### Other components

- **Administrator**
- **Target systems**
- **External services**

## Connections

- Administrator → Vuls CLI: runs (evidence: `cmd/vuls/main.go`)
- Vuls CLI → Scan command: dispatches (evidence: `cmd/vuls/main.go`)
- Scan command → Configuration: loads
- Scan command → OS scanners: starts scan
- Target systems → OS scanners: provides system data
- OS scanners → Scan results: collects data
- Scan command → HTTP server mode: supports server mode
- HTTP server mode → OS scanners: parses scan input (evidence: `server/server.go`)
- HTTP server mode → Detection orchestration: detects packages (evidence: `server/server.go`)
- HTTP server mode → Vulnerability matching: enriches results (evidence: `server/server.go`)
- Detection orchestration → Vulnerability matching: detects CVEs (evidence: `detector/detector.go`)
- Vulnerability matching → Vulnerability data: queries data
- Detection orchestration → Library scanning: checks libraries
- Detection orchestration → WordPress scanning: checks WordPress (evidence: `detector/detector.go`)
- Detection orchestration → Vulnerability results: assembles findings
- Vulnerability matching → CVE content models: enriches metadata
- Scan results → Detection orchestration: provides scan input (evidence: `detector/detector.go`)
- Administrator → Report command: requests report
- Report command → Detection orchestration: detects findings (evidence: `subcmds/report.go`)
- Report command → Report outputs: writes results
- Report outputs → Slack reports: supports Slack
- Report outputs → SBOM generation: generates SBOM
- Vulnerability results → Terminal viewer: displays findings (evidence: `tui/tui.go`)
- Report outputs → External services: sends notifications