visa/visa-vulnerability-agentic-harness

Health v2 · maintenance only

Flags: young no_license

Adoption not part of the score

2601 stars · 362 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

VVAH is Visa's open-source agentic harness for autonomous vulnerability discovery, remediation, and validation using frontier AI models. It runs a four-phase, eleven-stage SAST pipeline that maps attack surfaces, verifies exploitability with multi-agent voting, emits Markdown and SARIF findings, and validates proposed fixes.

Use cases

• find vulnerabilities in a codebase with AI agents
• run an agentic SAST pipeline over my repository
• reduce false positives in AI security findings with multi-model voting
• generate SARIF reports for AI-discovered vulnerabilities
• automatically propose and validate security fixes
• build threat models before static analysis
• measure mean time to adapt for AI-found weaknesses

When to choose

• you want LLM-driven static analysis with adversarial verification to cut false positives
• you need structured SARIF/Markdown findings integrated into existing triage workflows
• you want vendor-neutral multi-model support across detection and remediation stages
• your priority is speeding up triage from AI-discovered weakness to validated fix

When to avoid

• you need a fast traditional SAST scanner without LLM API costs
• you require external code contributions, since the repo does not accept them
• you lack access to Anthropic or OpenAI-compatible model endpoints
• you need a fully deterministic, non-AI vulnerability scanner

Facets

framework · maturity active

security vulnerability-scanning agent-framework llm-inference testing security developer-tools artificial-intelligence python cli sast vulnerability-discovery agentic-pipeline sarif threat-modeling remediation multi-agent llm-security ai-agents linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="visa/visa-vulnerability-agentic-harness")