Getting Started

Install calvigil and run your first vulnerability scan in under 2 minutes.

Table of contents
  1. Installation
    1. Pre-built Binaries
    2. Docker
    3. From Source
    4. Go Install
  2. Verify Installation
  3. Your First Scan
    1. Example Output
  4. Next Steps

Installation

Pre-built Binaries

Download the latest release from GitHub Releases.

macOS (Apple Silicon):

curl -Lo calvigil.tar.gz https://github.com/Calsoft-Pvt-Ltd/calvigil/releases/latest/download/calvigil-darwin-arm64.tar.gz
tar xzf calvigil.tar.gz && sudo mv calvigil /usr/local/bin/

macOS (Intel):

curl -Lo calvigil.tar.gz https://github.com/Calsoft-Pvt-Ltd/calvigil/releases/latest/download/calvigil-darwin-amd64.tar.gz
tar xzf calvigil.tar.gz && sudo mv calvigil /usr/local/bin/

macOS Gatekeeper: If you see “calvigil cannot be opened because Apple cannot verify it”, run:

xattr -dr com.apple.quarantine ./calvigil

Linux (amd64):

curl -Lo calvigil.tar.gz https://github.com/Calsoft-Pvt-Ltd/calvigil/releases/latest/download/calvigil-linux-amd64.tar.gz
tar xzf calvigil.tar.gz && sudo mv calvigil /usr/local/bin/

Debian / Ubuntu:

curl -Lo calvigil.deb https://github.com/Calsoft-Pvt-Ltd/calvigil/releases/latest/download/calvigil_5.0.0_amd64.deb
sudo dpkg -i calvigil.deb

RHEL / CentOS / Fedora:

curl -Lo calvigil.rpm https://github.com/Calsoft-Pvt-Ltd/calvigil/releases/latest/download/calvigil-5.0.0-1.x86_64.rpm
sudo rpm -i calvigil.rpm

Windows:

Download calvigil-windows-amd64.zip from Releases, extract, and add to your PATH.

Docker

Use the official multi-architecture Docker image:

docker run --rm calsoftit/calvigil-oss:latest version

Scan the current repository:

docker run --rm \
  -v "$PWD:/work" \
  -v "$HOME/.calvigil:/home/calvigil/.calvigil" \
  calsoftit/calvigil-oss:latest scan /work --skip-ai --skip-semgrep

Use calsoftit/calvigil-oss:latest for the latest stable release, edge for the latest main build, and vX.Y.Z or X.Y.Z for a pinned release. Optional runtime tools such as Semgrep and Syft are not installed in the base image.

From Source 

git clone https://github.com/Calsoft-Pvt-Ltd/calvigil.git
cd calvigil
make build
# binary is at ./bin/calvigil

Go Install 

go install github.com/Calsoft-Pvt-Ltd/calvigil@latest

Verify Installation 

calvigil version

Expected output:

calvigil version 5.0.0 (go1.22.x)

Your First Scan

Run a basic dependency vulnerability scan — no API keys needed:

calvigil scan /path/to/your/project

This will:

  1. Detect project ecosystems (Go, Python, Node.js, etc.)
  2. Parse all dependency lock files
  3. Query OSV.dev, plus Sonatype OSS Index when credentials are configured
  4. Check CISA KEV for actively exploited CVEs
  5. Print a table of findings

Example Output 

🔍 Scanning /home/user/my-app ...

📂 Detecting project ecosystems...
   Found 2 manifest files across 2 ecosystems
   - package-lock.json (npm)
   - requirements.txt (Python)

📦 Parsing dependencies...
   Parsed 142 packages
   Total: 142 packages (28 direct, 114 transitive)

🔎 Querying vulnerability databases...
   Found 5 dependency vulnerabilities (3 merged from multiple sources)

┌──────────────────┬──────────────┬──────────┬─────────────────┬───────────┐
│ ID               │ Package      │ Severity │ Installed       │ Fixed In  │
├──────────────────┼──────────────┼──────────┼─────────────────┼───────────┤
│ CVE-2024-1234 ⚠ KEV │ lodash  │ CRITICAL │ 4.17.20         │ 4.17.21   │
│ CVE-2024-5678    │ express      │ HIGH     │ 4.17.1          │ 4.18.2    │
│ CVE-2024-9012    │ requests     │ MEDIUM   │ 2.28.0          │ 2.31.0    │
└──────────────────┴──────────────┴──────────┴─────────────────┴───────────┘

⚠️ Known exploited (CISA KEV): 1 — prioritize these fixes

Next Steps