hevnsnt/CVEngine

选用指南

AI 根据 README 整理 · 2026/10/26 02:56:20

适用场景

适用于需要持续监控外部攻击面、识别已知漏洞并验证风险的安全团队，以及进行漏洞赏金项目范围扫描的研究人员。

查看 README 依据

<img src="docs/images/cvengine-tour.gif" alt="A tour of cvENGINE: the live dashboard, hosts ranked by score, a validated CVE match, the change timeline with screenshot diffs, and the asset graph" width="900"> </p> ## Why cvENGINE Attack surface tools find assets. Vulnerability scanners find flaws. Threat feeds find CVEs. cvENGINE runs all three as one continuous loop and hands you a verdict instead of a pile of alerts. It answers the one question that matters: **which of today's vulnerabilities are live on assets I own, and can I reproduce them?**

**Operate.** A live dashboard, an AI activity log, and a Changes page with side-by-side screenshot diffs. Rescan, pin, exclude, or archive any host, and record its owner and criticality. Organizations, projects, roles (admin, user, audit), an All projects view, two-step sign-in, an IP allowlist, and an audit log. A REST API, an MCP server, and an OpenAPI spec so agents work under the same permissions. A [bug bounty workbench](docs/BUG-BOUNTY.md) for hunters: browse HackerOne, Bugcrowd, Intigriti, and YesWeHack programs and scope, point the scanner at what is in scope, and draft reports from

使用方式

通过 Docker Compose 部署，提供 Web 界面、REST API 和 MCP 服务器，支持命令行管理。

查看 README 依据

- **Verdicts, not noise.** AI triages your findings, read-only checks reproduce what they can, and fixed rules mean the model can never wave away hard evidence. Every check records exactly what it ran. - **Nothing changes unseen.** New hosts, opened ports, version bumps, new certificates, login pages that appear, and front pages that change all land on a timeline. - **Scanning in minutes.** One Docker Compose stack with every scanner built in. No agents to install, no cloud account to open.

**Operate.** A live dashboard, an AI activity log, and a Changes page with side-by-side screenshot diffs. Rescan, pin, exclude, or archive any host, and record its owner and criticality. Organizations, projects, roles (admin, user, audit), an All projects view, two-step sign-in, an IP allowlist, and an audit log. A REST API, an MCP server, and an OpenAPI spec so agents work under the same permissions. A [bug bounty workbench](docs/BUG-BOUNTY.md) for hunters: browse HackerOne, Bugcrowd, Intigriti, and YesWeHack programs and scope, point the scanner at what is in scope, and draft reports from

You need Linux with [Docker Engine](https://docs.docker.com/engine/install/) and the Compose plugin, plus `git`, `make`, and `python3`. 8 GB of RAM and 20 GB of disk are recommended. ```bash git clone https://github.com/hevnsnt/CVEngine.git cd CVEngine cp .env.example .env # set DOMAIN_NAME and replace every change-me make certs # HTTPS certificate for the built-in proxy make up # build and start (the first build takes about 30 minutes) make username # create your admin account ```

部署要求

需要 Linux 系统、Docker Engine 及 Compose 插件，推荐 8GB 内存和 20GB 磁盘空间。

查看 README 依据

You need Linux with [Docker Engine](https://docs.docker.com/engine/install/) and the Compose plugin, plus `git`, `make`, and `python3`. 8 GB of RAM and 20 GB of disk are recommended. ```bash git clone https://github.com/hevnsnt/CVEngine.git cd CVEngine cp .env.example .env # set DOMAIN_NAME and replace every change-me make certs # HTTPS certificate for the built-in proxy make up # build and start (the first build takes about 30 minutes) make username # create your admin account ```

已知限制

仅扫描授权系统；默认不扫描私有范围，需手动允许；AI 功能需要配置模型 API 密钥或本地模型。

查看 README 依据

- Loopback, link-local, and cloud metadata addresses are never scanned, private ranges stay off until you allow them, and addresses on shared platforms such as CDNs are never port-scanned. - Injection attempts are blocked, and at the strike threshold the account is disabled and the source IP is blocked for 24 hours. - Each project's data is isolated, and stored secrets are encrypted. - Two-step sign-in, an IP allowlist, and an audit log protect access. Only scan systems you own or are authorized to test. ## Documentation | Doc | What it covers | | --- | --- |

its findings. Off until an admin enables it. Slack, Discord, Telegram, and Lark alerts if you don't want to monitor a dashboard. One switch pauses all scanning. Memory-aware scheduling keeps small servers healthy, and updates drain running work first or deploy automatically on every new commit. **Bring your own AI.** Anthropic, OpenAI, OpenRouter, Ollama, or vLLM, with keys stored encrypted. Without a model, cvENGINE still discovers, scans, matches CVEs, and validates findings. The AI adds triage, targeted scans, and template drafts. ## Built on the best