AutoCVE automates the path from an open-source project to a CVE submission: selecting a project, importing its repository, creating an audit task, running agent-driven vulnerability discovery, and generating the report used to file the entry. The interface is a web front end backed by a FastAPI service and PostgreSQL.
An orchestrator schedules five agent roles -- Recon, Scan, Triage, Finding, and Verification -- which between them gather information, run scanning tools, filter false positives, dig into candidate vulnerabilities, and verify them dynamically before results are merged and finalised. The Finding agent is the one aimed at CVE work: it reads project source directly and combines a ReAct loop, targeted tool calls, nudge-based correction, and a structured FinalizeFinding termination step.
Three audit modes trade scan speed against depth:
| Mode | Core agents | Suited to |
|---|---|---|
| Enhanced scan | Scan, Triage | quickly analysing scanner output and filtering false positives |
| Intelligent audit | Finding | deep discovery of high-value issues, for CVE and zero-day research |
| Combined audit | Scan, Triage, Finding | pairing tool scanning with source analysis for full coverage |
The full audit becomes conversational context, so you can question a result afterwards and have the agent add evidence, explain the attack chain, complete reproduction steps, or extend the analysis. An audit-tracking view collects the activity log, agent tree, tool calls, stage progress, preliminary report, and audit sessions. Vulnerabilities found during an audit are submitted by the agent through a tool call, deduplicated, and stored in structured form for management in a dedicated module, and each agent can be given its own skills to extend what it can do.
Recorded results from a one-week test are 30 vulnerabilities across 14 open-source projects, with CVSS scores up to 9.9; the published detail includes CVE identifiers, project, vulnerability type, and score. The project states it is for authorised security research, code auditing, and study only, and that scanning, verification, and proof-of-concept testing belong on explicitly authorised targets, with disclosure following each project's own security policy.
Features
- End-to-end CVE workflow: project screening, repository import, audit task, agent discovery, and report generation in one pipeline
- Multi-agent orchestration: Recon, Scan, Triage, Finding, and Verification agents coordinated by an orchestrator
- Finding agent: source-level discovery built on a ReAct loop with tool calls, nudge correction, and structured termination
- Three audit modes: enhanced scan, intelligent audit, and the two combined
- Interactive follow-up: the audit history is session context, so you can ask for more evidence or a fuller attack chain
- Audit tracing: activity log, agent tree, tool calls, stage progress, and preliminary report in one view
- Vulnerability management: agent-submitted findings deduplicated and stored in structured form
- Per-agent skills: each agent can be configured with its own skills
- Deployment: a single Docker Compose command, or a source build, exposing the front end, backend API, Swagger docs, and a database admin console
