Analyze Dockerfiles, Containerfiles, and compose files. Optionally compose with Trivy / Grype / Syft when those binaries are present.

Resolve dependency-version conflicts that block a fix. Finds a compatible safe version set across the dep graph.

Fetch Snort, Suricata, YARA, and Nuclei detection content for a vulnerability. Filters rule families to the user's installed detection stack.

Flag end-of-life runtimes and packages in the repo. Surfaces EOL Node, Python, Java, Go, .NET, base images, and key libraries.

Scan Terraform / OpenTofu / Nix / Kubernetes manifests for misconfigurations and compliance violations.

Cross-reference CISA/EU KEV (Known Exploited Vulnerabilities) catalogs with installed dependencies. Surfaces actively exploited CVEs hitting this repo.

Detect license conflicts and policy violations across dependencies. Outputs SPDX SBOM with license findings.

Get a context-aware remediation plan for a vulnerability with fix verification steps

Run Vulnetix SAST against changed files (or whole repo). Cross-references local Semgrep rules when present.

Detect hardcoded secrets (API keys, tokens, credentials) in repo. Pre-commit and on-demand.

Daily threat-intel digest combining AI-discovered vulns, in-the-wild exploitation, AI-malware families, exploit trends, and vendor trends.

Detect malware and typosquats among installed dependencies (and prospective additions).

Produces a bundle suitable for audit / attestation submission.

A focused playbook when a CVE is hot. Composes IOC pivot, detection rules, fix planning, and VEX in a single linear flow.