AutoCVE

AutoCVE is an open-source, AGPL-3.0 platform published by larlarua on GitHub that uses LLM agents to audit open-source code for vulnerabilities and prepare CVE submission reports. The latest listed release is v1.0.5, and it deploys with Docker Compose.

The README says the workflow covers project selection, repository import, audit task creation, agent-based vulnerability discovery, and CVE report generation.

What It Is

AutoCVE is a web application with a React frontend and a FastAPI backend, backed by PostgreSQL. Users configure a model, import a project, create an audit task, follow the audit live, manage the findings, and edit or export the report. An Orchestrator coordinates Recon, Scan, Triage, Finding, and Verification agents. Together they handle information gathering, tool scanning, false-positive filtering, deeper vulnerability analysis, and dynamic verification.

Audit Modes and Agents

Three audit modes are offered. Enhanced Scan runs Scan then Triage to analyze tool results and filter false positives. Smart Audit uses the Finding agent for deep source analysis aimed at CVE and 0-day research. Comprehensive Audit combines both. The Finding agent works through a ReAct loop with specialized tools, nudge-based correction, and a structured FinalizeFinding termination step.

Interaction, Findings and Skills

The full audit session serves as conversation context, so users can ask follow-up questions, request more evidence, or have the attack chain explained. The interface shows activity logs, an Agent Tree, tool calls, stage progress, and preliminary reports. Agents submit findings through tools, which are deduplicated and stored in a vulnerability management module. Per-agent Skills can be configured.

Results and Responsible Use

The README reports that in a one-week test, AutoCVE found and submitted 30 vulnerabilities across 14 open-source projects. Full reports are linked from a separate repository. The project states that it is only for authorized security research and code audits, and asks users to follow each target's disclosure policy.