Everything VulnForge does, in one place.

The autonomous pipeline handles the entire lifecycle. Clone, analyze, scan, filter, verify, and stage findings for review — all from one Git URL or local path. Pause mid-pipeline and resume later. Batch mode scans multiple targets in parallel. No-AI mode works out of the box.

• Paste-a-URL hunts — auto-detect language and pick the right tools
• Pause / resume — long-running jobs survive restarts
• Batch mode — parallel multi-target
• No-AI mode — add providers later

The Runtime page is where candidates become proofs. Drive any finding into a real, isolated environment without leaving VulnForge — fuzz the function, step through it in gdb, detonate the exploit in a disposable Docker container or full-system QEMU VM, capture the network traffic live, scan a host with nmap, or symbolically execute the binary. Every job streams output to the UI and MCP agents, pauses and resumes without losing state, and attaches its evidence directly to the finding. Ten executor types, one orchestration layer.

• libFuzzer — auto-generated harness from the function signature, ASAN+UBSAN, coverage-guided, minimized reproducers
• gdb sessions — scripted breakpoints with assertion validation, persistent across restarts, attach or launch
• Docker sandboxes — disposable containers, dropped caps, no-net by default, snapshot → run → rewind → export delta
• QEMU full-system VMs — boot a kernel, run the exploit, rewind with qcow2 snapshots, kernel-mode tracing
• tcpdump + tshark — live capture, sliceable PCAP, protocol-anomaly feed into AI pipeline
• nmap — host & service scanning with fingerprint matching
• angr symbolic execution — craft inputs that reach a sink under constraints
• radare2 / rizin — disassembly, string xrefs, decompilation indexed for the investigator
• Pause / resume / cancel — every job, including long-running fuzz runs, without losing state
• MCP-drivable — agents can spawn runtime jobs and read output via tools.call

A persistent research journal with kanban board for hypothesis tracking (open → investigating → confirmed → disproved). Markdown notes with YAML frontmatter. Pluggable backends: local filesystem today, Obsidian vault today, Notion and Logseq planned. Quick-capture from anywhere with Ctrl/Cmd+N. Investigation context survives restarts.

• Hypothesis board — 4-column kanban
• Markdown notes — YAML frontmatter, full-text search
• Pluggable backends — Local · Obsidian (Notion/Logseq planned)
• Quick capture — Ctrl/Cmd+N from anywhere
• Server-side session — investigation context persists

Sync CVEs from NVD and cross-reference against your target's dependencies. Use git bisect to pinpoint the commit that introduced a vulnerability. Extract patterns from historical security commits to power variant hunting.

• NVD sync — fetch CVEs, cross-reference deps
• Git bisect — pinpoint the bug-introducing commit
• Patch analysis — extract patterns from security commits

Export findings as SARIF 2.1 (compatible with GitHub, GitLab, and Azure DevOps security tabs) or CVE JSON 5.0 for CNA submission. Full workspace backup as JSON. Every action recorded in the audit trail.

• SARIF 2.1 — GitHub · GitLab · Azure DevOps compatible
• CVE JSON 5.0 — CNA submission format
• Workspace backup — full JSON dump
• Audit trail — every action logged