Vigolium is a web application vulnerability scanner with two complementary modes. Native Scan is a deterministic, multi-phase pipeline of scanner modules covering content discovery, browser and single-page-app spidering, and active and passive audit. Agentic Scan puts AI agents on top of that engine: they plan attacks, pick modules, write custom extensions, audit source code, and triage the results.
The native pipeline runs in layers: external harvesting, content discovery (Deparos, with fingerprint-based soft-404 detection), a Chromium-driven crawler (Spitolas) that captures traffic over the Chrome DevTools Protocol, and an audit phase. Scans take URLs, OpenAPI or Swagger specs, Postman collections, Burp Suite exports, cURL commands, or Nuclei output as input, and strategy presets and profiles control depth and pace. Authenticated scanning supports multiple sessions and automated login flows for IDOR (insecure direct object reference) and BOLA (broken object level authorization) testing.
The agentic side runs on an in-process Go agent engine called olium. Autopilot discovers endpoints, scans, and triages on its own. Swarm uses a master agent to choose modules, generate JavaScript attack extensions, run code audit and static analysis, and triage findings, either against one request or the full scope, and it can focus on a diff or recent commits. Source-code audits run through two separate harnesses: vigolium-audit, which drives the Claude or Codex CLI, and piolium, a Pi-native driver. A server mode exposes the same scans over a REST API, ingests traffic through a recording proxy or Burp Suite and Caido bridges, and can scan traffic as it arrives. A hosted Vigolium Cloud Console adds an autonomous agent with hosted scanning and shared results.
Features
- Scanner modules: 208 active fuzzing modules and 117 passive pattern-matching modules covering the OWASP Top 10 and beyond
- Out-of-band testing: blind XSS, SSRF, and command injection detected through interactsh callbacks with automatic payload correlation
- Value-aware mutation: parameters are classified by semantic type (integer, UUID, JWT, email) and mutated accordingly
- Flexible inputs: URLs, OpenAPI or Swagger, Postman, Burp Suite, cURL, and Nuclei JSONL
- Multi-session auth: inline sessions, session files, or login flows with token extraction for IDOR and BOLA testing
- JavaScript extensions: custom modules and hooks in an embedded JS engine with session-aware HTTP APIs
- Autopilot and Swarm agents: autonomous discovery, scanning, and triage, or a master agent that selects modules and writes custom attack extensions
- Source-code audit: vigolium-audit (Claude or Codex CLI) and piolium (Pi-native) drivers share one finding schema with deduplication
- Pluggable model providers: OpenAI-compatible by default, plus OpenAI, Anthropic, Anthropic on Vertex, and Google Vertex drivers
- Server mode: REST API with SSE streaming, an OpenAI-compatible chat endpoint, traffic ingestion, and scan-on-receive
- Proxy bridges: forward live traffic from Burp Suite or Caido into a running server
- Reporting: concurrent workers with per-host rate limits and self-contained HTML reports
