# protectai/vulnhuntr

Zero shot vulnerability discovery using LLMs

Repository: https://github.com/protectai/vulnhuntr
Canonical: https://ross.abutalabs.com/products/vulnhuntr
Language: Python
License: AGPL-3.0
License Family: copyleft
Topics: ai, llm, security, vulnerability-detection, static-analysis
Last push: 2025-02-06T18:04:15+00:00

## Health v2 (maintenance only)
Score: 24/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 5, release rhythm 35, longevity 49
- inputs: {"age_days": 687, "days_push": 573, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2747, forks 320 (observed 2026-08-28T04:07:17.471807+00:00)

## What it is
Vulnhuntr is a Python CLI tool that uses large language models combined with static code analysis to autonomously discover exploitable vulnerabilities in Python codebases. It traces complete call chains from remote user input to server output to find complex, multi-step security flaws that traditional static analyzers miss.

## Use cases
- find zero-day vulnerabilities in python projects with llm analysis
- audit open-source python codebases for rce and ssrf bugs
- discover security flaws that static analyzers miss
- hunt for exploitable bugs in ai and llm applications
- trace remote user input through code call chains to find vulnerabilities
- automate vulnerability discovery for bug bounty research
- scan python web apps for xss sqli and lfi issues

## When to choose
- you need to audit a Python codebase for remotely exploitable vulnerabilities
- traditional static analysis tools miss complex multi-step attack chains
- you are doing security research or bug bounty hunting on Python projects
- you want to find 0-days in popular AI/LLM applications

## When to avoid
- your codebase is not written in Python
- you need guaranteed complete coverage rather than LLM-assisted discovery
- you cannot provide LLM API access or handle the associated cost
- you need to scan non-Python languages like C, Go, or JavaScript

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, linter, llm-inference, nlp
- domain: security, developer-tools, artificial-intelligence, large-language-models, penetration-testing
- platform: python, cli, windows
- tags: vulnerability-discovery, zero-shot-analysis, llm-security-audit, python-code-audit, 0day-hunting, code-call-chain-analysis, security-research, responsible-disclosure, docker, linux, macos

## Member repositories
- protectai/vulnhuntr (main) score 24

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:17.471807+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T08:19:01.630332+00:00, confidence not recorded.
  - readme: https://github.com/protectai/vulnhuntr (fetched 2026-08-28T04:07:17.471807+00:00, sha 6fd4bd054238)
- Data as of 2026-08-30T08:39:29.467469+00:00.