Vigolium

https://docs.vigolium.com
Admin
Vigolium is a high-fidelity web vulnerability scanner that fuses agentic AI with native speed,...
Tokens:242,283
Snippets:2,415
Trust Score:3.1
Update:4 months ago
Show doc for...
Tokens:
Raw
### Install Preset JavaScript Extensions

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Install example extension scripts provided by Vigolium. Use the 'ext preset' command.

```bash
vigolium ext preset
```

--------------------------------

### Install Preset Extensions

Source: https://docs.vigolium.com/native-scan/phases/extension

Install pre-defined sets of extensions. This command simplifies the setup for common scanning tasks by providing ready-to-use modules.

```bash
# Install preset extensions
vigolium ext preset            # Install all presets
vigolium ext preset idor       # Install a specific preset
```

--------------------------------

### Example Create Project Response

Source: https://docs.vigolium.com/api-references/projects

This is an example of the JSON response after successfully creating a new project.

```json
{
  "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "name": "my-project",
  "description": "Web app audit",
  "created_at": "2026-03-06T12:00:00Z",
  "updated_at": "2026-03-06T12:00:00Z"
}
```

--------------------------------

### Top-Level CLI Commands

Source: https://docs.vigolium.com/others/cli-references

View all available commands, flags for specific commands, or a full example tour. Also shows how to get build and version information.

```bash
vigolium --help              # All available commands and global flags
vigolium <command> --help    # Flags and help for a specific command
vigolium --full-example      # Curated tour of all common usage
vigolium version             # Build and version info
```

--------------------------------

### Start Vigolium Server

Source: https://docs.vigolium.com/getting-started/server-and-ingestion

Start the Vigolium server with an API key. Use this for basic server startup.

```bash
# Start with an API key
export VIGOLIUM_API_KEY=my-secret-key
vigolium server
```

--------------------------------

### Vigolium Server Start Options

Source: https://docs.vigolium.com/others/cli-references

Commands to start the Vigolium REST API and ingest proxy with various configurations.

```bash
vigolium server                                              # Default host/port from config
vigolium server --host 0.0.0.0 --service-port 8443
vigolium server --no-auth                                    # Local use only — disables bearer auth
vigolium server -t https://example.com --scan-on-receive     # Auto-scan ingested traffic

# Transparent ingest proxy (records traffic flowing through it)
vigolium server --ingest-proxy-port 9003

# Intercept HTTPS too via a generated MITM CA (trust the CA printed at startup)
vigolium server --ingest-proxy-port 9003 --proxy-mitm -S
vigolium server --ingest-proxy-port 9003 --proxy-mitm --proxy-insecure   # skip upstream TLS verification

# Export the MITM CA certificate and exit (generates it if needed)
vigolium server --export-ca ./vigolium-ca.pem
```

--------------------------------

### Start Vigolium Web Server

Source: https://docs.vigolium.com/getting-started/web-ui

Run this command to start the Vigolium web server. The UI will be accessible at http://localhost:9002 by default.

```bash
vigolium server
```

--------------------------------

### Start Vigolium Server

Source: https://docs.vigolium.com/api-references/overview

Learn how to start the Vigolium server with different authentication and configuration options. Use the `-A` flag to enable authentication.

```bash
# No authentication (development)
vigolium server -A
```

```bash
# With API key
export VIGOLIUM_API_KEY="my-secret-key"
vigolium server -A
```

```bash
# Custom host/port
vigolium server -A --host 127.0.0.1 --service-port 8080
```

--------------------------------

### Scan Configuration Summary Example

Source: https://docs.vigolium.com/api-references/scan

Example of the scan configuration summary logged to stderr, showing effective settings for a scan.

```text
✦ Scan Configuration
  ℹ Project: my-project-uuid
  ℹ Strategy: balanced
  ℹ Phases: ✓ ExternalHarvest (24m0s, x0.2) | ✓ Spidering (18m0s, x0.2) | ✓ Discovery
            ✓ KnownIssueScan (6h0m0s, x3.0) | ✓ Dynamic-Assessment (2h0m0s, x1.0)
  ℹ Speed: concurrency=50 | rate-limit=100 | max-per-host=30
  ℹ Modules: 154 active, 97 passive
```

--------------------------------

### Install Vigolium Extensions

Source: https://docs.vigolium.com/customization/writing-extensions

Commands to install all preset extensions or a single specific preset to the default extensions directory.

```bash
# Install all presets to ~/.vigolium/extensions/
vigolium extensions preset

# Install a single preset
vigolium extensions preset reflected_param_scanner
```

--------------------------------

### Example Project Response

Source: https://docs.vigolium.com/api-references/projects

This is an example of the JSON response when listing projects, including detailed statistics.

```json
[
  {
    "uuid": "00000000-0000-0000-0000-000000000001",
    "name": "default",
    "description": "Default project",
    "owner_uuid": "00000000-0000-0000-0000-000000000001",
    "created_at": "2026-02-19T10:00:00Z",
    "updated_at": "2026-02-19T10:00:00Z",
    "stats": {
      "http_records": {
        "total": 1234,
        "success": 980,
        "redirect": 54,
        "client_err": 180,
        "server_err": 20
      },
      "findings": {
        "total": 42,
        "critical": 2,
        "high": 10,
        "medium": 15,
        "low": 10,
        "info": 5
      },
      "scans": 3,
      "agentic_scans": 7,
      "oast_interactions": 12
    }
  }
]
```

--------------------------------

### Install Vigolium via curl

Source: https://docs.vigolium.com/getting-started/quickstart

Installs the Vigolium binary to ~/.local/bin and updates your shell profile. The installer verifies the checksum before installation.

```bash
curl -fsSL https://vigolium.com/install.sh | bash
```

--------------------------------

### Start Vigolium Server with API Key

Source: https://docs.vigolium.com/getting-started/web-ui

Set the VIGOLIUM_API_KEY environment variable before starting the server for shared or production use. This command starts the server with API authentication enabled.

```bash
export VIGOLIUM_API_KEY=my-secret-key
vigolium server
```

--------------------------------

### Get Application Info Response

Source: https://docs.vigolium.com/api-references/overview

Example JSON response for the `/api/info` endpoint, containing application name, version, author, documentation link, build time, and commit hash.

```json
{
  "name": "vigolium",
  "version": "v0.1.8-alpha",
  "author": "vigolium",
  "docs": "https://docs.vigolium.com",
  "build_time": "2026-05-21T15:22:43Z",
  "commit": "67bdce4"
}
```

--------------------------------

### Install Pi and P மடங்கு Extension

Source: https://docs.vigolium.com/getting-started/agentic-security-audit

One-time installation for pi and the piolium extension. This is required before running piolium audits.

```bash
# Install pi + the piolium extension (one-time)
bun install -g @earendil-works/pi-coding-agent
pi install git:git@github.com:vigolium/piolium.git
```

--------------------------------

### Run Agent with Inline Prompt and Specific Files

Source: https://docs.vigolium.com/api-references/agent

Starts an agent run with a custom inline prompt and provides a list of specific files to include in the analysis context. This example demonstrates using curl for the API request.

```bash
curl -s -X POST http://localhost:9002/api/agent/run/query \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Analyze the authentication flow for vulnerabilities",
    "source": "/home/user/src/my-app",
    "files": ["src/auth/login.py", "src/auth/session.py"]
  }' | jq .
```

--------------------------------

### Start High-Concurrency Server

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Configure and start a Vigolium server optimized for high throughput, specifying the number of workers and memory buffer.

```bash
vigolium server -c 200 --mem-buffer 50000
```

--------------------------------

### Install Vigolium via Bun

Source: https://docs.vigolium.com/getting-started/quickstart

Installs the Vigolium launcher globally using Bun. This method is similar to npm but utilizes Bun as a faster package manager.

```bash
bun add -g @vigolium/vigolium
```

--------------------------------

### Custom Prompt Template Example

Source: https://docs.vigolium.com/customization/extending-vigolium

This example shows the structure of a custom prompt template, including frontmatter for metadata and Go template syntax for dynamic content injection. Use this to define custom analysis tasks for AI agents.

```markdown
---
id: my-custom-review
name: My Custom Review
description: What this template does
output_schema: findings    # or: http_records
variables:
  - SourceCode
  - Language
  - PreviousFindings
---

You are a security engineer. Analyze the following code for {{.Language}} vulnerabilities.

{{if .PreviousFindings}}
Previous findings to verify:
{{.PreviousFindings}}
{{end}}

Source code:
```
{{.SourceCode}}
```

Respond with JSON: {"findings": [...]}
```

--------------------------------

### GET /

Source: https://docs.vigolium.com/api-overview

Serves the static UI for the Vigolium application.

```APIDOC
## GET /

### Description
Serves the static UI for the Vigolium application.

### Method
GET

### Endpoint
/

### Parameters
#### Path Parameters
None

#### Query Parameters
None

### Request Example
None

### Response
#### Success Response (200)
- UI assets

#### Response Example
None
```

--------------------------------

### Vigolium Agent Query Examples

Source: https://docs.vigolium.com/others/cli-references

Examples of using the `agent query` subcommand for single-shot prompts, including specifying source code and prompt templates.

```bash
vigolium agent query --source ./src --prompt-template security-code-review
vigolium agent query --source ./src --prompt-template endpoint-discovery
vigolium agent query 'review this code for vulnerabilities'
vigolium agent query --agent-label code-review --prompt-file custom-prompt.md
vigolium agent --list-templates
```

--------------------------------

### Quick Install Vigolium Scanner Skill

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Installs the vigolium-scanner skill for a specified agent. Replace <agent-name> with your agent's identifier.

```bash
bunx skills add vigolium/skills --skill vigolium-scanner --agent <agent-name> --yes
```

--------------------------------

### Install Vigolium via npm

Source: https://docs.vigolium.com/getting-started/quickstart

Installs the Vigolium launcher globally using npm. This is a thin launcher that downloads the prebuilt binary for your platform.

```bash
npm install -g @vigolium/vigolium
```

--------------------------------

### Markdown Skill File Example

Source: https://docs.vigolium.com/agentic-scan/olium

Example of a skill file in Markdown format with YAML frontmatter. The 'name' and 'description' fields in the frontmatter have specific length constraints.

```markdown
```markdown theme={null}
---
name: triage-finding
description: Walk a candidate finding from suspicious response → root cause → PoC.
license: optional
allowed-tools: optional list
---

# Body
Instructional prose the model reads after calling load_skill.
```
```

--------------------------------

### Vigolium Agent Autopilot Examples

Source: https://docs.vigolium.com/others/cli-references

Examples of using the `agent autopilot` subcommand for autonomous agentic scans, including natural-language prompts and source-aware scanning.

```bash
# Natural-language prompt — target, source, and focus auto-extracted
vigolium agent autopilot "scan VAmPI source at ~/src/VAmPI on localhost:3005"
vigolium agent autopilot "test auth bypass on https://app.example.com"

# Plain target
vigolium agent autopilot -t https://example.com/api

# Source-aware (auto-runs vigolium-audit first to build context)
vigolium agent autopilot -t https://example.com --source ./src
vigolium agent autopilot -t https://example.com --source ./src --audit=off   # disable vigolium-audit
```

--------------------------------

### Vigolium Agent Swarm Examples

Source: https://docs.vigolium.com/others/cli-references

Examples of using the `agent swarm` subcommand for AI-guided multi-phase scans, including discovery and skill control.

```bash
vigolium agent swarm -t https://example.com --discover
vigolium agent swarm -t https://example.com --discover --focus 'API injection'

# Skill control (force-load attack-vector skills, bypass planner selection)
vigolium agent swarm -t https://example.com --discover --skill-tag xss,idor
vigolium agent swarm -t https://example.com --discover --no-skill-filter
```

--------------------------------

### Logging with vigolium.log

Source: https://docs.vigolium.com/customization/writing-extensions

Provides examples of using the `vigolium.log` module for different logging levels.

```javascript
vigolium.log.info(msg)
vigolium.log.warn(msg)
vigolium.log.error(msg)
vigolium.log.debug(msg)
```

--------------------------------

### Verify Setup with Smoke Test

Source: https://docs.vigolium.com/getting-started/agentic-security-audit

Run this command to ensure your Vigolium audit setup is working correctly. It performs a lite audit and writes findings to the database.

```bash
vigolium agent audit --driver=audit --source . --mode lite
```

--------------------------------

### Get Health Check Response

Source: https://docs.vigolium.com/api-references/overview

Example JSON response for the `/health` endpoint, showing the server's current status and a timestamp.

```json
{
  "status": "healthy",
  "timestamp": "2026-02-16T15:30:00Z"
}
```

--------------------------------

### Get Server Info Response

Source: https://docs.vigolium.com/api-references/overview

Example JSON response for the `/server-info` endpoint, providing comprehensive details about the Vigolium server's operational status and configuration.

```json
{
  "name": "vigolium",
  "version": "v0.1.8-alpha",
  "author": "vigolium",
  "docs": "https://docs.vigolium.com",
  "build_time": "2026-05-21T15:22:43Z",
  "commit": "67bdce4",
  "uptime": "5m32s",
  "service_addr": "0.0.0.0:9002",
  "proxy_addr": "",
  "queue_depth": 0,
  "total_records": 1234,
  "total_findings": 42,
  "license_spdx": "AGPL-3.0",
  "source": "https://github.com/vigolium/vigolium"
}
```

--------------------------------

### Agent Run Started Response

Source: https://docs.vigolium.com/api-references/agent

Example of the JSON response received when an agent query run is successfully initiated asynchronously. It includes a unique UUID for tracking the run.

```json
{
  "agentic_scan_uuid": "agt-550e8400-e29b-41d4-a716-446655440000",
  "status": "running",
  "message": "query run started"
}
```

--------------------------------

### Initialize Vigolium

Source: https://docs.vigolium.com/others/cli-references

Initializes the ~/.vigolium directory with default configurations.

```bash
vigolium init
```

--------------------------------

### GET /api/diagnostics

Source: https://docs.vigolium.com/api-references/diagnostics

Returns a diagnostic report checking database connectivity, agent provider readiness, third-party tools, and directory configuration. Useful for verifying the scanner is ready to operate before starting scans.

```APIDOC
## GET /api/diagnostics, System Readiness Check

### Description
Returns a diagnostic report checking database connectivity, agent provider readiness, third-party tools, and directory configuration. Useful for verifying the scanner is ready to operate before starting scans.

### Method
GET

### Endpoint
/api/diagnostics

### Parameters
#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
curl -s -H "Authorization: Bearer $TOKEN" http://localhost:9002/api/diagnostics | jq .
```

### Response
#### Success Response (200)
- **status** (string) - Overall system status (`ready`, `degraded`, `not_ready`).
- **timestamp** (string) - The time the diagnostic check was performed.
- **database** (object) - Status of the database connection.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **message** (string) - Details about the database connection.
- **queue** (object) - Status of the message queue.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **message** (string) - Details about the queue status (e.g., depth).
- **agent** (object) - Status of the agent provider.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **name** (string) - The name of the agent.
  - **provider** (string) - The provider of the agent.
  - **model** (string) - The model used by the agent.
- **browser** (object) - Status of the browser check.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **message** (string) - Details about the browser status (e.g., disabled).
- **tools** (object) - Status of various tools.
  - **chromium** (object) - Status of the Chromium tool.
    - **status** (string) - `ok`, `warning`, or `error`.
    - **path** (string) - The path to the Chromium executable.
- **templates_dir** (object) - Status of the templates directory.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **message** (string) - Details about the templates directory (e.g., path, count).
- **sessions_dir** (object) - Status of the sessions directory.
  - **status** (string) - `ok`, `warning`, or `error`.
  - **message** (string) - Details about the sessions directory (e.g., path, writability).

#### Response Example
```json
{
  "status": "degraded",
  "timestamp": "2026-04-29T03:40:08+08:00",
  "database": {
    "status": "ok",
    "message": "driver=sqlite"
  },
  "queue": {
    "status": "ok",
    "message": "depth=0"
  },
  "agent": {
    "status": "ok",
    "name": "olium",
    "provider": "openai-codex-oauth",
    "model": "gpt-5.5"
  },
  "browser": {
    "status": "warning",
    "message": "disabled in config"
  },
  "tools": {
    "chromium": {
      "status": "ok",
      "path": "/opt/homebrew/bin/chromium"
    }
  },
  "templates_dir": {
    "status": "ok",
    "message": "path=~/.vigolium/prompts, templates=38"
  },
  "sessions_dir": {
    "status": "ok",
    "message": "path=~/.vigolium/agent-sessions, writable=true"
  }
}
```
```

--------------------------------

### Start Server with Transparent Proxy for Recording

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Initialize the Vigolium server with a transparent proxy on a specified port (e.g., 8080) for traffic recording.

```bash
vigolium server --ingest-proxy-port 8080
```

--------------------------------

### Inline Session Examples

Source: https://docs.vigolium.com/native-scan/authentication

Shows how to configure single or multiple inline sessions using the `--auth` flag for cookies and bearer tokens.

```bash
# Single session with a cookie
vigolium scan https://app.com --auth "admin:Cookie:session_id=abc123"

# Bearer token
vigolium scan https://app.com --auth "user1:Authorization:Bearer eyJhbGciOi..."

# Multiple sessions for IDOR testing
vigolium scan https://app.com \
  --auth "admin:Cookie:session=admin_token" \
  --auth "regular:Cookie:session=user_token"
```

--------------------------------

### Run a Swarm AI-Guided Multi-Phase Scan

Source: https://docs.vigolium.com/getting-started/server-and-ingestion

Initiates a multi-phase scan guided by AI, starting with input discovery and proceeding to triage. Use for complex, multi-stage security assessments. Set 'stream' to true for real-time SSE output.

```bash
curl -s -X POST http://localhost:9002/api/agent/run/swarm \
  -H "Authorization: Bearer my-secret-key" \
  -H "Content-Type: application/json" \
  -d '{
    "input": "https://example.com",
    "discover": true,
    "triage": true,
    "stream": true
  }'
```

--------------------------------

### Example Requests

Source: https://docs.vigolium.com/native-scan/scan-scope

Illustrates a series of 500 requests to a host, highlighting the optimization where modules only run on the first request.

```text
Request #1:   GET /api/users HTTP/1.1        Host: example.com
Request #2:   POST /api/login HTTP/1.1       Host: example.com
Request #3:   GET /products?id=42 HTTP/1.1   Host: example.com
...
Request #500: GET /about HTTP/1.1            Host: example.com
```

--------------------------------

### Example HTTP Request

Source: https://docs.vigolium.com/native-scan/scan-scope

This is an example of an HTTP POST request with various parameters that the scanner analyzes.

```http
POST /api/search?lang=en HTTP/1.1
Host: example.com
Cookie: session=abc123
Content-Type: application/x-www-form-urlencoded

query=test&page=1
```

--------------------------------

### httpx Proxy Example

Source: https://docs.vigolium.com/server-mode/proxy

Pipe a list of URLs to httpx and configure it to use the Vigolium proxy for requests.

```bash
echo "https://example.com" | httpx -proxy http://localhost:9003
```

--------------------------------

### Quick Start: Inline and File-Based Authentication

Source: https://docs.vigolium.com/native-scan/authentication

Demonstrates basic usage of Vigolium's authentication flags for inline sessions, single-session files, and multi-session bundle files.

```bash
# Inline session (simplest)
vigolium scan https://app.com --auth "admin:Cookie:session_id=abc123"

# Single-session file (YAML or JSON)
vigolium scan https://app.com --auth-file ./admin-session.yaml
vigolium scan https://app.com --auth-file ./admin-session.json

# Multi-session bundle file (sessions: key, YAML or JSON)
vigolium scan https://app.com --auth-file ./auth-config.yaml
vigolium scan https://app.com --auth-file ./auth-config.json
```

--------------------------------

### View All Configuration

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Use `vigolium config ls` to display all current Vigolium configuration settings.

```bash
vigolium config ls
```

--------------------------------

### OAST Interaction Deletion Response Example

Source: https://docs.vigolium.com/api-references/oast-interactions

Example of a successful response after deleting an OAST interaction.

```json
{
  "message": "OAST interaction deleted",
  "id": 1
}

```

--------------------------------

### Start Server with Scan-on-Receive

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Launch the Vigolium server and configure it to automatically scan all incoming requests.

```bash
vigolium server -t https://example.com --scan-on-receive
```

--------------------------------

### Show Extension API Documentation

Source: https://docs.vigolium.com/native-scan/phases/extension

Access documentation for the extension API, including usage examples, to understand how to write and use extensions effectively.

```bash
# Show API documentation
vigolium ext docs
vigolium ext docs --example    # Include usage examples
```

--------------------------------

### Create a New Project

Source: https://docs.vigolium.com/api-references/projects

Use this command to create a new project. Include the project name and optionally a description and owner UUID in the JSON request body. Requires `jq` for pretty-printing JSON.

```bash
curl -s -X POST http://localhost:9002/api/projects \
  -H 'Content-Type: application/json' \
  -d '{"name": "my-project", "description": "Web app audit"}' | jq .
```

--------------------------------

### Validate Vigolium Installation

Source: https://docs.vigolium.com/getting-started/quickstart

Checks the installed Vigolium version and runs a diagnostic check for missing dependencies or configuration issues.

```bash
vigolium version
vigolium doctor
```

--------------------------------

### Create and Manage Projects

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Manage projects using `vigolium project create`, `vigolium project list`, and `vigolium project use` to switch between projects.

```bash
vigolium project create my-project
```

```bash
vigolium project list
```

```bash
vigolium project use my-project
```

--------------------------------

### Build Vigolium from Source

Source: https://docs.vigolium.com/getting-started/quickstart

Clones the Vigolium repository and builds the binary from source. Requires Go 1.26+, Bun 1.3.11+, git, and make. Use 'make build' for version metadata injection.

```bash
git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build
```

--------------------------------

### Vigolium Agent Swarm CLI Examples

Source: https://docs.vigolium.com/agentic-scan/swarm

This section provides a cheat sheet for various Vigolium agent swarm CLI commands. These examples demonstrate how to target specific URLs, include source analysis, enable triage and rescans, perform full-scope sweeps, use intensity presets, resume previous runs, pipe input from other commands, force extension generation, render prompts without LLM calls, and specify different LLM providers.

```bash
# Minimum: target only — model picks modules from probed responses
vigolium agent swarm --target https://app.example.com
```

```bash
# Source-aware: 4-call source analysis + code audit
vigolium agent swarm --target https://app.example.com --source ./repo
```

```bash
# With triage and rescans (verifies findings, retries)
vigolium agent swarm --target https://app.example.com --triage --max-iterations 3
```

```bash
# Full-scope sweep — discovery + planning + scanning
vigolium agent swarm --target https://app.example.com --discover
```

```bash
# Use a preset
vigolium agent swarm --target https://app.example.com --intensity deep
```

```bash
# Start from a specific phase using an existing session
vigolium agent swarm --resume <run-id> --start-from plan
```

```bash
# Pipe a curl command — input auto-detected
echo "curl -X POST https://app.example.com/api/login -d '{\"u\":\"a\"}'" | vigolium agent swarm
```

```bash
# Force extension generation even when the master returns none
vigolium agent swarm -t https://app.example.com --force-extensions
```

```bash
# Render prompts without calling the LLM
vigolium agent swarm --target https://app.example.com --dry-run --show-prompt
```

```bash
# Use a different olium provider for this run
vigolium agent swarm -t https://app.example.com \
  --provider anthropic-api-key --model claude-opus-4-7
```

--------------------------------

### Using Session Files with Vigolium

Source: https://docs.vigolium.com/native-scan/authentication

Illustrates how to apply YAML or JSON session configuration files using the `--auth-file` flag.

```bash
vigolium scan https://app.com --auth-file ./admin-session.yaml
vigolium scan https://app.com --auth-file ./admin-session.json
```

--------------------------------

### Start Server on Custom Port Without Authentication

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Start the Vigolium server on a custom port (e.g., 8443) and disable authentication.

```bash
vigolium server --service-port 8443 --no-auth
```

--------------------------------

### Get Application Info

Source: https://docs.vigolium.com/api-references/overview

Retrieve basic application metadata by making a GET request to the `/api/info` endpoint. The response is in JSON format.

```bash
curl -s http://localhost:9002/api/info | jq .
```

--------------------------------

### Filter GET Requests with Status Code > 399

Source: https://docs.vigolium.com/api-references/database

Combines filters to retrieve GET requests with a status code greater than 399.

```bash
curl -s 'http://localhost:9002/api/db/tables/http_records/records?filter.method=GET&filter.status_code__gt=399' | jq .
```

--------------------------------

### Full Request with Parameters Example

Source: https://docs.vigolium.com/native-scan/scan-scope

Shows a full HTTP request with parameters and the corresponding behavior across different scan scopes (InsertionPoint, Request, Host).

```http
POST /api/login?ref=home HTTP/1.1
Host: example.com
Cookie: lang=en
Content-Type: application/json

{"username":"admin","password":"secret"}
```

--------------------------------

### Example Create Record Response

Source: https://docs.vigolium.com/api-references/database

Illustrates the JSON response after successfully creating a record.

```json
{
  "table": "scopes",
  "message": "record created"
}
```

--------------------------------

### GET /api/extensions/:name, Get Extension

Source: https://docs.vigolium.com/api-references/extensions

Retrieves the full metadata and raw file content for a specific extension, identified by its filename.

```APIDOC
## GET /api/extensions/:name, Get Extension

### Description
Returns full metadata plus raw file content for a single extension, looked up by filename.

### Method
GET

### Endpoint
/api/extensions/:name

### Parameters
#### Path Parameters
- **name** (string) - Required - Filename of the extension (e.g. `reflected_param_scanner.js` or `sensitive_header_leak.vgm.yaml`)

### Response
#### Success Response (200)
- **id** (string) - Unique identifier for the extension.
- **name** (string) - Human-readable name of the extension.
- **language** (string) - Programming language of the extension (`js` or `yaml`).
- **type** (string) - Type of the extension (`active`, `passive`, `pre_hook`, `post_hook`).
- **severity** (string) - Severity level of the extension (e.g., `medium`, `info`).
- **confidence** (string) - Confidence level of the extension (e.g., `firm`, `certain`).
- **scan_types** (array of strings) - Types of scans the extension is applicable to.
- **tags** (array of strings) - Tags associated with the extension for categorization and searching.
- **description** (string) - A brief description of the extension's functionality.
- **file** (string) - The absolute path to the extension file on the server.
- **file_name** (string) - The filename of the extension.
- **raw_content** (string) - The raw content of the extension file.

#### Error Responses
- **404** - Extension not found among loaded extensions.

### Request Example
```bash
curl -s http://localhost:9002/api/extensions/reflected_param_scanner.js | jq .
curl -s http://localhost:9002/api/extensions/sensitive_header_leak.vgm.yaml | jq .
```

### Response Example
```json
{
  "id": "reflected-param-scanner",
  "name": "Reflected Parameter Scanner",
  "language": "js",
  "type": "active",
  "severity": "medium",
  "confidence": "firm",
  "scan_types": ["per_insertion_point"],
  "tags": ["injection", "xss", "moderate"],
  "description": "Injects a canary value into each parameter and checks if the response reflects it back",
  "file": "/home/user/.vigolium/extensions/reflected_param_scanner.js",
  "file_name": "reflected_param_scanner.js",
  "raw_content": "// reflected_param_scanner.js\nmodule.exports = { id: \"reflected-param\", ... }"
}
```
```

--------------------------------

### Install Vigolium Scanner Skill with npx

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Installs the vigolium-scanner skill using npx. Ensure to replace <agent-name> with the correct agent identifier.

```bash
npx skills add vigolium/skills --skill vigolium-scanner --agent <agent-name> --yes
```

--------------------------------

### Start Vigolium Server with Transparent HTTP Proxy

Source: https://docs.vigolium.com/getting-started/server-and-ingestion

Enable a transparent HTTP proxy for recording traffic. Essential for capturing network requests.

```bash
# With transparent HTTP proxy for recording traffic
export VIGOLIUM_API_KEY=my-secret-key
vigolium server --ingest-proxy-port 9003
```

--------------------------------

### Append Extra Instructions to Template

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Enhance a prompt template with additional, specific instructions. This example appends a focus on authentication and authorization to the 'security-code-review' template.

```bash
vigolium agent query --prompt-template security-code-review --source ./src \
  --append "Focus specifically on authentication and authorization vulnerabilities"
```

--------------------------------

### Create a GCS Bucket

Source: https://docs.vigolium.com/api-references/storage

This snippet demonstrates creating a Google Cloud Storage bucket and granting the service account necessary permissions. Replace `gs://my-vigolium-bucket` with your desired bucket name and region.

```bash
# Create a bucket in your preferred region
gcloud storage buckets create gs://my-vigolium-bucket \
  --location=asia-southeast1 \
  --uniform-bucket-level-access

# Grant the service account read/write access
gcloud storage buckets add-iam-policy-binding gs://my-vigolium-bucket \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/storage.objectAdmin"

```

--------------------------------

### GraphQL API Request Example

Source: https://docs.vigolium.com/native-scan/scan-scope

Example of a GraphQL API request with nested JSON structures, demonstrating potential insertion points for scanning.

```http
POST /api/graphql HTTP/1.1
Host: example.com
Content-Type: application/json

{"query":"{ user(id: 1) { name } }","variables":{"token":"eyJhbGci..."}}
```

--------------------------------

### Running Vigolium Autopilot Agent

Source: https://docs.vigolium.com/getting-started/choosing-a-mode

Shows how to initiate the Autopilot agent for black-box scanning, with options for source-aware scanning and integrating the audit agent.

```bash
# Pure black-box
vigolium agent autopilot -t https://example.com --intensity balanced

```

```bash
# Source-aware — pairs blackbox runtime checks with whitebox code reading
vigolium agent autopilot -t https://example.com --source ~/src/your-app

```

```bash
# Throw vigolium-audit into the mix in the background
vigolium agent autopilot -t https://example.com --source ~/src/your-app --audit=balanced

```

--------------------------------

### OAST Interaction Detail Response Example

Source: https://docs.vigolium.com/api-references/oast-interactions

Example response for a single OAST interaction, including detailed fields like raw_request and raw_response.

```json
{
  "id": 1,
  "scan_uuid": "scan-456",
  "unique_id": "abc123def456",
  "full_id": "abc123def456.oast.fun",
  "protocol": "http",
  "q_type": "",
  "raw_request": "GET / HTTP/1.1\r\nHost: abc123def456.oast.fun\r\n\r\n",
  "raw_response": "HTTP/1.1 200 OK\r\n\r\n<html>...</html>",
  "remote_address": "203.0.113.42",
  "interacted_at": "2026-02-16T15:10:00Z",
  "target_url": "https://example.com/api/users?id=1",
  "parameter_name": "id",
  "injection_type": "param_value",
  "module_id": "ssrf-detection",
  "created_at": "2026-02-16T15:10:01Z"
}

```

--------------------------------

### List Available Templates and Agents

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

List all available prompt templates and Olum providers that can be used with the Vigolium agent.

```bash
vigolium agent --list-templates
```

```bash
vigolium agent --list-agents
```

--------------------------------

### Get Finding Detail

Source: https://docs.vigolium.com/api-references/findings

Retrieve a single finding by its numeric ID. Use this endpoint to get detailed information about a specific security finding.

```bash
curl -s http://localhost:9002/api/findings/1 | jq .
```

--------------------------------

### Install Vigolium via Homebrew

Source: https://docs.vigolium.com/getting-started/quickstart

Installs the latest Vigolium release from the official Homebrew tap on macOS and Linux. Use 'brew upgrade vigolium' to update.

```bash
brew install vigolium/tap/vigolium
```

--------------------------------

### System Readiness Report (JSON)

Source: https://docs.vigolium.com/api-references/diagnostics

Example JSON response from the /api/diagnostics endpoint, detailing the status of various system components including database, queue, agent, browser, tools, and directories.

```json
{
  "status": "degraded",
  "timestamp": "2026-04-29T03:40:08+08:00",
  "database": {
    "status": "ok",
    "message": "driver=sqlite"
  },
  "queue": {
    "status": "ok",
    "message": "depth=0"
  },
  "agent": {
    "status": "ok",
    "name": "olium",
    "provider": "openai-codex-oauth",
    "model": "gpt-5.5"
  },
  "browser": {
    "status": "warning",
    "message": "disabled in config"
  },
  "tools": {
    "chromium": {
      "status": "ok",
      "path": "/opt/homebrew/bin/chromium"
    }
  },
  "templates_dir": {
    "status": "ok",
    "message": "path=~/.vigolium/prompts, templates=38"
  },
  "sessions_dir": {
    "status": "ok",
    "message": "path=~/.vigolium/agent-sessions, writable=true"
  }
}
```

--------------------------------

### Swarm Scan Skipping Discovery and Starting from Planning

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Starts a swarm scan from the planning phase, assuming existing data in the database and skipping the discovery phase.

```bash
vigolium agent swarm --discover -t https://example.com --skip discover --start-from plan
```

--------------------------------

### Install and Configure Pi-native Driver for Audits

Source: https://docs.vigolium.com/getting-started/setup-agent

Set up the Pi coding-agent runtime and the piolium extension for more thorough source-code audits. Configure Pi's default provider and authentication.

```bash
# 1. Install Pi runtime.
bun install -g @earendil-works/pi-coding-agent
pi --version

# 2. Install the piolium extension.
pi install git:git@github.com:vigolium/piolium.git
pi list                                # verify "piolium" appears

# 3. Configure pi's default provider (the audit subprocess uses pi's own auth,
#    not vigolium's). Example with Anthropic:
pi login                               # or: pi /login

# 4. Run an audit.
vigolium agent audit --driver=piolium --source ~/src/your-app                            # balanced (default)
vigolium agent audit --driver=piolium --source ~/src/your-app --mode lite               # quick triage
vigolium agent audit --driver=piolium --source ~/src/your-app --intensity deep          # full 17-phase

# 5. Override pi's provider/model just for this run if you want.
vigolium agent audit --driver=piolium --source ~/src/your-app \
  --pi-provider vertex-anthropic --pi-model claude-opus-4-6
```

--------------------------------

### Get Health Check Status

Source: https://docs.vigolium.com/api-references/overview

Check the server's health status by sending a GET request to the `/health` endpoint. The response indicates if the server is 'healthy'.

```bash
curl -s http://localhost:9002/health | jq .
```

--------------------------------

### Decision Guide: AI-Guided Dynamic Scan with Source

Source: https://docs.vigolium.com/native-scan/scanning-modes-overview

Combines AI planning with source code analysis for dynamic scanning. Includes code audit capabilities.

```bash
vigolium agent swarm -t URL --source ./app --code-audit
```

--------------------------------

### List All Projects

Source: https://docs.vigolium.com/api-references/projects

Use this command to retrieve a list of all projects. The output includes aggregated statistics for each project. Requires `jq` for pretty-printing JSON.

```bash
# List all projects
curl -s http://localhost:9002/api/projects | jq .
```

--------------------------------

### Session Artifacts Response Example

Source: https://docs.vigolium.com/api-references/agent

Example JSON response structure for the list session artifacts endpoint, showing file names, sizes, modification times, and types.

```json
{
  "agentic_scan_uuid": "agt-550e8400-e29b-41d4-a716-446655440000",
  "session_dir": "/home/user/.vigolium/agent-sessions/agt-550e8400-...",
  "artifacts": [
    {"name": "swarm-plan.json", "size": 2048, "modified_at": "2026-05-21T10:01:00Z", "kind": "file"},
    {"name": "extensions/sqli-custom.js", "size": 1024, "modified_at": "2026-05-21T10:02:00Z", "kind": "file"},
    {"name": "vigolium-audit/findings/p8-001.md", "size": 4096, "modified_at": "2026-05-21T10:03:00Z", "kind": "file"}
  ],
  "truncated": false
}
```

--------------------------------

### Load Multiple Extensions

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Specify multiple extensions by using the `--ext` flag multiple times for each extension file.

```bash
vigolium scan -t https://example.com --ext check1.js --ext check2.js --ext check3.js
```

--------------------------------

### JavaScript Passive Extension Example

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Example of a passive JavaScript extension that checks for missing security headers in HTTP responses. It defines metadata and implements the `scanPerRequest` function.

```javascript
module.exports = {
  id: "missing-security-headers",
  name: "Missing Security Headers",
  type: "passive",
  severity: "low",
  confidence: "certain",
  scope: "response",
  tags: ["headers", "misconfiguration", "light"],
  scanTypes: ["per_request"],

  scanPerRequest: function(ctx) {
    if (!ctx.response) return null;
    var headers = ctx.response.headers;
    var missing = [];

    if (!headers["strict-transport-security"]) missing.push("HSTS");
    if (!headers["x-content-type-options"]) missing.push("X-Content-Type-Options");
    if (!headers["x-frame-options"] && !headers["content-security-policy"]) {
      missing.push("X-Frame-Options/CSP");
    }

    if (missing.length === 0) return null;

    return {
      url: ctx.request.url,
      name: "Missing Security Headers: " + missing.join(", "),
      severity: "low",
      description: "Response is missing: " + missing.join(", ")
    };
  }
};

```

--------------------------------

### Combine Auth with Other Scan Options

Source: https://docs.vigolium.com/native-scan/authentication

Demonstrates using authentication configuration files alongside other scan options like strategy, module targeting, concurrency, and output formatting.

```bash
vigolium scan https://app.example.com \
  --auth-file ./auth-config.json \
  --strategy blackbox \
  --only audit \
  --concurrency 10 \
  --format html -o report.html
```

--------------------------------

### OAST Interactions List Response Example

Source: https://docs.vigolium.com/api-references/oast-interactions

This is an example of a paginated response when listing OAST interactions. It includes basic details but excludes raw request and response data.

```json
{
  "data": [
    {
      "id": 1,
      "scan_uuid": "scan-456",
      "unique_id": "abc123def456",
      "full_id": "abc123def456.oast.fun",
      "protocol": "dns",
      "q_type": "A",
      "remote_address": "203.0.113.42",
      "interacted_at": "2026-02-16T15:10:00Z",
      "target_url": "https://example.com/api/users?id=1",
      "parameter_name": "id",
      "injection_type": "param_value",
      "module_id": "ssrf-detection",
      "created_at": "2026-02-16T15:10:01Z"
    }
  ],
  "total": 12,
  "limit": 50,
  "offset": 0,
  "has_more": false
}

```

--------------------------------

### Get Server Information

Source: https://docs.vigolium.com/api-references/overview

Retrieve detailed server information, including uptime, database driver, queue depth, and record/finding totals, via a GET request to `/server-info`.

```bash
curl -s http://localhost:9002/server-info | jq .
```

--------------------------------

### Module Execution for Insertion Points

Source: https://docs.vigolium.com/native-scan/scan-scope

Illustrates how compatible modules are run in parallel for each identified insertion point, showing example payloads and checks.

```text
Insertion Point #1: lang=en (URL_PARAM)
  ├── sqli_error_based  →  lang=' OR 1=1--     → check response for SQL errors
  ├── ssti_detection    →  lang={{7*7}}         → check response for "49"
  ├── lfi_generic       →  lang=../../etc/passwd → check response for "root:"
  ├── crlf_injection    →  lang=%0d%0aX:injected → check response headers
  └── ... (all PER_INSERTION_POINT modules that accept URL_PARAM)

Insertion Point #2: session=abc123 (COOKIE)
  ├── sqli_error_based  →  session=' OR 1=1--  → check response
  ├── ssti_detection    →  session={{7*7}}      → check response
  └── ... (only modules that accept COOKIE type)

Insertion Point #3: query=test (BODY_PARAM)
  ├── sqli_error_based  →  query=' OR 1=1--    → check response
  ├── ssti_detection    →  query={{7*7}}        → check response
  ├── ssrf_detection    →  query=http://burp.co → check for OOB callback
  └── ...

... and so on for each insertion point
```

--------------------------------

### Load All Extensions from a Directory

Source: https://docs.vigolium.com/agentic-scan/using-vigolium-in-your-agent

Use the `--ext-dir` flag to load all extensions located within a specified directory.

```bash
vigolium scan -t https://example.com --ext-dir ./my-extensions/
```

--------------------------------

### Static File GET Request

Source: https://docs.vigolium.com/native-scan/scan-scope

Shows a GET request for a static CSS file. Most modules are skipped by default filters, but passive checks like secret detection may still run.

```http
GET /assets/style.css HTTP/1.1
Host: example.com
```
Tokens:
Raw