Calvigil
AI-Powered Vulnerability Scanner CLI
An open-source security scanner for Go, Java, Python, Node.js, Rust, Ruby, PHP, and C/C++ projects. Combines dependency scanning, AI code analysis, SAST, container image scanning, IaC scanning, and license compliance in one tool.
Key Features
| Feature | Description |
|---|---|
| Dependency Scanning | Checks lock files against OSV.dev plus configured Sonatype OSS Index, NVD, and GitHub Advisory databases |
| Canonical Data Model | Normalizes all sources — merges duplicates, fills missing severity, eliminates UNKNOWN |
| CISA KEV Enrichment | Flags vulnerabilities actively exploited in the wild with ⚠ KEV |
| AI Code Analysis | OpenAI GPT-4, Ollama, or LM Studio detect OWASP Top 10 vulnerabilities in your code |
| SAST (Semgrep) | 101 bundled security rules plus custom rule support |
| Pattern Detection | 52 built-in rules (29 SEC + 23 AI-generated code quality) plus custom regex rule packs |
| Container Scanning | Scan Docker/OCI images via Syft SBOM extraction |
| Binary/SCA Scanning | Extract dependencies from Go binaries, JARs, and Python wheels |
| IaC Scanning | 25 rules for Terraform, Kubernetes, Dockerfile, CloudFormation, Helm |
| License Compliance | SPDX classification with copyleft/permissive/unknown categorization |
| Supply Chain | Integrity verification, phantom dependency detection, malicious package checks |
| Multiple Outputs | Table, JSON, SARIF, CycloneDX, SPDX, OpenVEX, HTML, PDF |
Quick Example
# Basic dependency scan (no API keys needed)
calvigil scan /path/to/project
# Full scan with AI analysis
calvigil scan --ai /path/to/project
# Container image scan
calvigil scan-image nginx:latest
# IaC security scan
calvigil scan-iac ./terraform/
# JSON output for CI/CD
calvigil scan --format json --output results.json .
Vulnerability Databases
calvigil queries four vulnerability databases and enriches results with one more:
| Database | Always On | Notes |
|---|---|---|
| OSV.dev | ✅ | Batch API, no limits, primary source |
| Sonatype OSS Index | Optional | PURL-based, requires existing/migrated credentials |
| NVD | Optional | Requires API key for best rate limits |
| GitHub Advisory | Optional | Requires GitHub token |
| CISA KEV | ✅ | Enrichment — flags exploited-in-the-wild CVEs |
All results are normalized through a Canonical Data Model that:
- Prefers CVE IDs as canonical identifiers
- Merges findings across databases (fills missing severity, scores, and fix versions)
- Derives severity from CVSS vectors when sources omit a label
Supported Ecosystems
| Language | Manifest Files |
|---|---|
| Go | go.mod |
| Python | requirements.txt, Pipfile.lock, poetry.lock, uv.lock |
| Node.js | package-lock.json, yarn.lock, pnpm-lock.yaml |
| Java | pom.xml, build.gradle, build.gradle.kts |
| Rust | Cargo.lock |
| Ruby | Gemfile.lock |
| PHP | composer.lock |
| C/C++ | conan.lock |
About
calvigil is developed by Calsoft Pvt Ltd and released under the MIT License.
Current version: 5.0.0