VulnSink

A CLI tool that wraps SAST scanners and uses LLMs to filter false positives and automatically fix security issues.

Features

- Run any CLI-based SAST tool (Semgrep, ESLint, Bandit, etc.)
- Use AI to distinguish true positives from false positives
- Generate and apply secure code fixes automatically
- Terminal interface with:
- Real-time progress indicators with spinners
- Color-coded severity levels and confidence scores
- Organized findings with all relevant details
- Analysis includes reasoning and recommendations
- JSON output for CI/CD pipelines
- Automatic backups and dry-run mode

Installation

``bash
npm install -g vulnsink
`

Quick Start

1. Initialize configuration:
`bash
vulnsink init
`

2. Set your OpenRouter API key (choose one):

Option A: Using .env file (recommended)
`bash
cp .env.example .env
# Edit .env and add your API key
`

Option B: Environment variable
`bash
export OPENROUTER_API_KEY=your_key_here
`

3. Run a scan:
`bash
vulnsink scan
`

4. Scan and auto-fix issues:
`bash
vulnsink scan --fix
`

UI Showcase

$3

Edit vulnsink.config.json:

`json
{
"tools": [
{
"name": "semgrep",
"command": "semgrep scan --sarif",
"outputFormat": "sarif"
}
],
"llm": {
"provider": "openrouter",
"model": "anthropic/claude-3.5-sonnet",
"apiKey": "${OPENROUTER_API_KEY}"
},
"filtering": {
"confidenceThreshold": 70,
"showFalsePositives": false
},
"fixing": {
"autoFix": false,
"requireConfirmation": true,
"createBackup": true,
"minConfidenceToFix": 80
},
"contextLines": 10
}
`

$3

Semgrep (SARIF format):
`json
{
"name": "semgrep",
"command": "semgrep scan --sarif",
"outputFormat": "sarif"
}
`

Semgrep (JSON format):
`json
{
"name": "semgrep",
"command": "semgrep scan --json",
"outputFormat": "json"
}
`

ESLint with security plugin:
`json
{
"name": "eslint",
"command": "eslint . --format json",
"outputFormat": "json"
}
`

Important: Make sure the command output format matches the outputFormat setting:
- Use --sarif flag with "outputFormat": "sarif"
- Use --json flag with "outputFormat": "json"

$3

VulnSink automatically loads environment variables from a .env file in your project root.

Supported variables:

| Variable | Description | Example |
|----------|-------------|---------|
| OPENROUTER_API_KEY | OpenRouter API key (required) | sk-or-v1-... |
| LLM_MODEL | Override default LLM model | anthropic/claude-opus-4 |
| CONFIDENCE_THRESHOLD | Override default threshold | 80 |

Setup:

1. Copy the example file:
`bash
cp .env.example .env
`

2. Edit .env and add your values:
`bash
OPENROUTER_API_KEY=sk-or-v1-your-key-here
`

3. The config file can reference environment variables:
`json
{
"llm": {
"apiKey": "${OPENROUTER_API_KEY}"
}
}
`

Note: .env files are automatically ignored by git for security.

Commands

$3

Run a security scan with interactive UI.

Arguments:
- path: Directory to scan (default: current directory)

Options:
- --path