hevnsnt/CVEngine

cvENGINE is worth a look if you need continuous attack-surface mapping for assets you own and want findings filtered down to reproducible CVE matches rather than raw scanner noise. It is a self-hosted, GPL-3.0 toolkit assembled around established scanners; expect that self-hosting and validating its AI triage will be the real work, not the install.

The problem

The usual workflow is three separate chores: a subdomain/discovery tool to find what is exposed, a port and service scanner to identify versions, then a vulnerability scanner whose output you manually reconcile against what is actually deployed. Each list is stale by the time it is read, and deciding whether a CVE applies means cross-referencing fingerprints by hand. cvENGINE turns that into one loop: you add a domain, IP, CIDR range or URL, and the project runs discovery, inventory, exposure checks, correlation and triage as a single pipeline, storing results in a searchable inventory rather than handing back a pile of alerts project pipeline. The result is a dashboard of hosts and findings that keeps itself current, including a weekly deep sweep for apex domains.

What's different

The distinguishing move is the combination of discovery and validation in one place. cvENGINE uses bbot for subdomain and asset discovery across passive, standard and deep modes, then nmap and naabu for inventory, nuclei and its templates for known-check detection, plus optional WPScan and RDP screenshotting README. It then ranks CVEs according to its own "fire, smoke, and ice" scheme and attempts read-only reproduction where possible rating method. The AI layer is used for targeted nuclei passes and triage, not for generating findings from scratch, which is the more sensible design for a security tool.

The trade-off is complexity and dependency on third-party scanners and feeds. cvENGINE is a fork of reNgine 2.x and inherits a large scanner stack upstream project. Its verdict quality depends on the CVE feed, the template set and the AI model you configure; the README does not provide independent accuracy benchmarks. The "safe by design" claims are project assertions about scanner configuration (read-only template filtering, one no-password database attempt, skips for loopback, link-local and cloud metadata addresses), not an audit result. It also exposes an API and an MCP endpoint so developer agents can query results, which is useful for teams already running agents but adds an access surface to secure agent API docs.

Who should try it

A good fit is a small security or infrastructure team with a known set of owned domains and a Linux host to spare, wanting a free alternative to per-asset commercial attack-surface products. It also suits teams that want agent access to scan results through the documented API or MCP endpoint, with read-only tokens possible. A poor fit is someone who wants a quick one-off scan on a laptop: this is a server application with Docker, PostgreSQL and a certificate setup. It is also a poor fit for anyone who cannot use Linux. The documented installation path targets Debian or Ubuntu with a one-command installer, with a manual Docker Compose path for other Linux hosts.

Requirements and limitations

The README calls for a Linux server, recommends at least 4 GB RAM and 20 GB disk, and requires Docker Engine plus the Compose plugin, git, make and python3 on the manual path install instructions. The one-command installer installs Docker, generates secrets and creates a private HTTPS certificate authority that browsers will warn about until you trust the generated CA certificate. That is a setup step every user on the network must understand, and the generated admin password is shown only once.

Ongoing work is non-trivial: the scanner stack, CVE feed and templates need updating, and the optional AI model and search-engine keys must be configured for the advertised triage and search behavior. Private ranges stay off until explicitly allowed, which is correct for an external-assessment tool but means internal-only testing needs a deliberate policy change. The GPL-3.0 license also matters if you plan to redistribute a modified version license.

HotRepo's take

HotRepo's only recorded signal is a NEW-REPOSITORY board (新项目榜) observation on 2026-10-26, showing 135 total stars at #25 for Python. That is a single snapshot of a one-day-old repository, not a daily growth measurement, and there is no comparable daily-board history to judge whether interest persists. The project is too young to infer momentum. Before spending time, check the AI triage configuration in the architecture docs and decide whether you can supply a model and API access it expects.