# mohamed2007sarhan/vulnintel architecture

> Architecture diagram of the GitHub repository mohamed2007sarhan/vulnintel, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mohamed2007sarhan/vulnintel
- Repository: https://github.com/mohamed2007sarhan/vulnintel

## Overview

VulnIntel is a defensive vulnerability-intelligence desktop platform. Its main workflow monitors vulnerability feeds, searches public exploit sources, analyzes candidates with AI, records findings, and generates detection rules and reports; users can also search publicly and manage authorized lab targets and validation results. The README documents AI-generated PoCs, queue fallbacks, and database rotation, but the excerpts do not establish all their internal call paths, so those links are omitted. The GUI pipeline excerpt supports its feed, exploit, and detection orchestration; other subsystem wiring is shown only where documented or evidenced.

Main entry points: [`gui/app.py`](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/app.py) (GUI application), [`gui/public_search_frame.py`](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/public_search_frame.py) (Public search), [`database/db_manager.py`](https://github.com/mohamed2007sarhan/vulnintel/blob/main/database/db_manager.py) (SQLite records), [`lab/lab_manager.py`](https://github.com/mohamed2007sarhan/vulnintel/blob/main/lab/lab_manager.py) (Lab manager)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["Desktop interface"]
  node_app["GUI application<br/>[app.py]"]
  node_publicsearch["Public search"]
  node_cveui["CVE browser"]
  node_queueui["Processing queue<br/>[queue_frame.py]"]
  node_labui["Lab interface<br/>[lab_frame.py]"]
  node_reportui["Reports interface<br/>[reports_frame.py]"]
end

subgraph group_intelligence["Intelligence pipeline"]
  node_nvd["NVD source<br/>[nvd_source.py]"]
  node_githubadv["GitHub advisories"]
  node_exploitdb["Exploit-DB source"]
  node_sploitus["Sploitus source<br/>[sploitus_source.py]"]
end

subgraph group_analysis["Analysis and safety"]
  node_ai["AI analyzer<br/>[ai_analyzer.py]"]
  node_cveanalysis["CVE analysis<br/>[cve_analyzer.py]"]
  node_classifier["Exploit classifier"]
  node_safety["Safety policy<br/>[safety_policy.py]"]
end

subgraph group_operations["Lab operations"]
  node_labmanager["Lab manager<br/>[lab_manager.py]"]
  node_sandbox["Sandbox workflow"]
  node_sigma["Sigma rules<br/>[sigma_generator.py]"]
  node_yara["YARA rules<br/>[yara_generator.py]"]
  node_ioc["IOC summaries<br/>[ioc_generator.py]"]
  node_remediation["Remediation<br/>[remediation.py]"]
  node_reportgen["Report generator"]
end

subgraph group_records["Persistence and outputs"]
  node_db[("SQLite records<br/>[db_manager.py]")]
end

node_user(("Defensive analyst"))
node_nvdservice(("NVD API"))
node_githubservice(("GitHub Advisories"))
node_exploitservice(("Exploit sources"))
node_llmservice(("AI model API"))

node_user -->|"uses"| node_app
node_app -->|"opens"| node_publicsearch
node_app -->|"opens"| node_cveui
node_app -->|"opens"| node_queueui
node_app -->|"opens"| node_labui
node_app -->|"opens"| node_reportui
node_app -->|"fetches CVEs"| node_nvd
node_app -->|"fetches advisories"| node_githubadv
node_app -->|"searches exploits"| node_exploitdb
node_app -->|"searches exploits"| node_sploitus
node_app -->|"stores findings"| node_db
node_app -->|"generates rules"| node_sigma
node_app -->|"generates rules"| node_yara
node_app -->|"generates summaries"| node_ioc
node_app -->|"requests analysis"| node_ai
node_publicsearch -->|"searches CVEs"| node_nvd
node_publicsearch -->|"searches exploits"| node_exploitdb
node_publicsearch -->|"searches exploits"| node_sploitus
node_publicsearch -->|"searches PoCs"| node_githubadv
node_publicsearch -->|"stores exploits"| node_db
node_nvd -->|"requests data"| node_nvdservice
node_githubadv -->|"requests data"| node_githubservice
node_exploitdb -->|"searches"| node_exploitservice
node_sploitus -->|"searches"| node_exploitservice
node_ai -->|"sends prompts"| node_llmservice
node_labui -->|"manages targets"| node_labmanager
node_labmanager -->|"validates target"| node_safety
node_labmanager -->|"records targets"| node_db
node_labmanager -->|"records results"| node_db
node_sandbox -->|"checks policy"| node_safety
node_reportui -->|"requests report"| node_reportgen
node_reportui -->|"reads records"| node_db
node_reportgen -->|"includes guidance"| node_remediation
node_cveui -->|"requests analysis"| node_cveanalysis
node_cveui -->|"classifies exploits"| node_classifier

click node_app "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/app.py"
click node_publicsearch "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/public_search_frame.py"
click node_cveui "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/cve_browser_frame.py"
click node_queueui "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/queue_frame.py"
click node_labui "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/lab_frame.py"
click node_reportui "https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/reports_frame.py"
click node_nvd "https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/nvd_source.py"
click node_githubadv "https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/github_advisories.py"
click node_exploitdb "https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/exploitdb_source.py"
click node_sploitus "https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/sploitus_source.py"
click node_ai "https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/ai_analyzer.py"
click node_cveanalysis "https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/cve_analyzer.py"
click node_classifier "https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/exploit_classifier.py"
click node_safety "https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/safety_policy.py"
click node_labmanager "https://github.com/mohamed2007sarhan/vulnintel/blob/main/lab/lab_manager.py"
click node_sandbox "https://github.com/mohamed2007sarhan/vulnintel/blob/main/lab/sandbox_workflow.py"
click node_sigma "https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/sigma_generator.py"
click node_yara "https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/yara_generator.py"
click node_ioc "https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/ioc_generator.py"
click node_remediation "https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/remediation.py"
click node_reportgen "https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/report_generator.py"
click node_db "https://github.com/mohamed2007sarhan/vulnintel/blob/main/database/db_manager.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_publicsearch,node_cveui,node_queueui,node_labui,node_reportui toneBlue
class node_nvd,node_githubadv,node_exploitdb,node_sploitus toneAmber
class node_ai,node_cveanalysis,node_classifier,node_safety,node_nvdservice,node_llmservice toneMint
class node_labmanager,node_sandbox,node_sigma,node_yara,node_ioc,node_remediation,node_reportgen toneRose
class node_db,node_user,node_githubservice,node_exploitservice toneIndigo
```

## Components

### Desktop interface

- [GUI application](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/app.py): `gui/app.py`
- [Public search](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/public_search_frame.py): `gui/public_search_frame.py`
- [CVE browser](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/cve_browser_frame.py): `gui/cve_browser_frame.py`
- [Processing queue](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/queue_frame.py): `gui/queue_frame.py`
- [Lab interface](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/lab_frame.py): `gui/lab_frame.py`
- [Reports interface](https://github.com/mohamed2007sarhan/vulnintel/blob/main/gui/reports_frame.py): `gui/reports_frame.py`

### Intelligence pipeline

- [NVD source](https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/nvd_source.py): `sources/nvd_source.py`
- [GitHub advisories](https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/github_advisories.py): `sources/github_advisories.py`
- [Exploit-DB source](https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/exploitdb_source.py): `sources/exploitdb_source.py`
- [Sploitus source](https://github.com/mohamed2007sarhan/vulnintel/blob/main/sources/sploitus_source.py): `sources/sploitus_source.py`

### Analysis and safety

- [AI analyzer](https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/ai_analyzer.py): `analysis/ai_analyzer.py`
- [CVE analysis](https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/cve_analyzer.py): `analysis/cve_analyzer.py`
- [Exploit classifier](https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/exploit_classifier.py): `analysis/exploit_classifier.py`
- [Safety policy](https://github.com/mohamed2007sarhan/vulnintel/blob/main/analysis/safety_policy.py): `analysis/safety_policy.py`

### Lab operations

- [Lab manager](https://github.com/mohamed2007sarhan/vulnintel/blob/main/lab/lab_manager.py): `lab/lab_manager.py`
- [Sandbox workflow](https://github.com/mohamed2007sarhan/vulnintel/blob/main/lab/sandbox_workflow.py): `lab/sandbox_workflow.py`
- [Sigma rules](https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/sigma_generator.py): `generators/sigma_generator.py`
- [YARA rules](https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/yara_generator.py): `generators/yara_generator.py`
- [IOC summaries](https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/ioc_generator.py): `generators/ioc_generator.py`
- [Remediation](https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/remediation.py): `generators/remediation.py`
- [Report generator](https://github.com/mohamed2007sarhan/vulnintel/blob/main/generators/report_generator.py): `generators/report_generator.py`

### Persistence and outputs

- [SQLite records](https://github.com/mohamed2007sarhan/vulnintel/blob/main/database/db_manager.py): `database/db_manager.py`

### Other components

- **Defensive analyst**
- **NVD API**
- **GitHub Advisories**
- **Exploit sources**
- **AI model API**

## Connections

- Defensive analyst → GUI application: uses
- GUI application → Public search: opens
- GUI application → CVE browser: opens
- GUI application → Processing queue: opens
- GUI application → Lab interface: opens
- GUI application → Reports interface: opens
- GUI application → NVD source: fetches CVEs
- GUI application → GitHub advisories: fetches advisories
- GUI application → Exploit-DB source: searches exploits
- GUI application → Sploitus source: searches exploits
- GUI application → SQLite records: stores findings
- GUI application → Sigma rules: generates rules
- GUI application → YARA rules: generates rules
- GUI application → IOC summaries: generates summaries
- GUI application → AI analyzer: requests analysis
- Public search → NVD source: searches CVEs
- Public search → Exploit-DB source: searches exploits
- Public search → Sploitus source: searches exploits
- Public search → GitHub advisories: searches PoCs
- Public search → SQLite records: stores exploits
- NVD source → NVD API: requests data
- GitHub advisories → GitHub Advisories: requests data
- Exploit-DB source → Exploit sources: searches
- Sploitus source → Exploit sources: searches
- AI analyzer → AI model API: sends prompts
- Lab interface → Lab manager: manages targets
- Lab manager → Safety policy: validates target
- Lab manager → SQLite records: records targets
- Lab manager → SQLite records: records results
- Sandbox workflow → Safety policy: checks policy
- Reports interface → Report generator: requests report
- Reports interface → SQLite records: reads records
- Report generator → Remediation: includes guidance
- CVE browser → CVE analysis: requests analysis
- CVE browser → Exploit classifier: classifies exploits