Vulnetix CLI & GitHub Action

Automated vulnerability management for your CI/CD pipelines and development workflows.

Contents

• GitHub Action
• Claude Code Plugin
• CLI Installation
• Available Tasks
• Documentation
• CLI Documentation
• Claude Code Plugin Documentation
• VDB API Reference
• GitHub App

---

GitHub Action

This GitHub Action provides the Vulnetix CLI for your workflows, enabling automated vulnerability scanning directly in your CI/CD pipeline.

Basic Usage

- name: Vulnetix Scan
  uses: Vulnetix/[email protected]
  with:
    org-id: ${{ secrets.VULNETIX_ORG_ID }}
    api-key: ${{ secrets.VULNETIX_API_KEY }}

Workflow Examples

Scan on Pull Request

name: Security Scan
on: [pull_request]
permissions:
  contents: read

jobs:
  vulnetix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: Vulnetix/cli@v3
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}

Upload Artifacts

- uses: Vulnetix/[email protected]
  with:
    org-id: ${{ secrets.VULNETIX_ORG_ID }}
    api-key: ${{ secrets.VULNETIX_API_KEY }}
    task: upload
    artifact-path: ./reports/

See GitHub Actions documentation for complete configuration options, and Artifact Upload guide for uploading workflow artifacts to Vulnetix.

Other CI/CD Platforms

Platform	Guide
GitLab CI	GitLab pipeline integration
Azure DevOps	Azure pipeline integration
Bitbucket	Bitbucket pipeline integration

---

Claude Code Plugin

Integrate Vulnetix vulnerability intelligence directly into Claude Code with automated pre-commit scanning, six interactive analysis skills, and multi-hook architecture.

Install

Add the marketplace:

/plugin marketplace add Vulnetix/pix-ai-coding-assistant

Install the plugin:

/plugin install vulnetix@vulnetix-plugins

Upgrade

/plugin update vulnetix

Requires: Vulnetix CLI installed and authenticated (vulnetix auth login).

Full plugin documentation | Plugin repository

---

CLI Installation

Method	Platforms	Installation
Install Script	Linux, macOS	curl -fsSL https://cli.vulnetix.com/install.sh | sh
Homebrew	Linux, macOS	brew install vulnetix/tap/vulnetix
Scoop	Windows	scoop install vulnetix
Nix	Linux, macOS	nix profile install github:Vulnetix/cli
Go Install	All	go install github.com/vulnetix/cli/v3@latest
Binary Download	All	Direct download
From Source	All	Build from source

Architecture support: AMD64, ARM64, ARM, 386.

Quick Start

brew install vulnetix/tap/vulnetix
vulnetix auth login
vulnetix vdb status

See CLI Documentation for complete usage and command reference.

---

Available Tasks

Task	Description	Use Case
info	Auth healthcheck (default)	Verify credential setup

---

Using the CycloneDX Go Module

Other Go projects can generate the same Vulnetix CycloneDX document shape by importing github.com/Vulnetix/vdb-cyclonedx directly:

package main

import (
	"os"

	cyclonedx "github.com/Vulnetix/vdb-cyclonedx"
)

func main() {
	bom, err := cyclonedx.BuildSBOM(cyclonedx.SBOMInventory{
		Packages: []cyclonedx.SBOMPackage{{
			Name:       "example",
			Version:    "1.2.3",
			Ecosystem:  "golang",
			Scope:      "production",
			SourceFile: "go.mod",
			SourceType: "manifest",
			IsDirect:   true,
		}},
	}, cyclonedx.SBOMOptions{
		SpecVersion: "1.7",
		ToolName:    "my-builder",
		ToolVersion: "1.0.0",
	})
	if err != nil {
		panic(err)
	}
	_ = os.WriteFile("sbom.cdx.json", bom, 0o644)
}

BuildSBOM can also merge AIDetections and CryptoDetections so a single CycloneDX file carries package SBOM, AIBOM and CBOM components, accepts a resolved dependency graph via SBOMInventory.Dependencies, and takes an optional SBOMOptions.CanonicalSPDXID hook so recognised licenses are emitted as license.id instead of free text. The builder validates the output against the bundled CycloneDX schema before returning JSON.

vulnetix cdx (alias vulnetix sbom) is the CLI front end for this: it discovers packages from manifests, installed package trees, container package databases, Dockerfiles, CI/CD pipeline files, shell scripts and the metadata compiled into Go, Rust and JVM artefacts, then writes one validated CycloneDX file offline.

---

Documentation

• CLI Documentation
• Claude Code Plugin Documentation
• VDB API Reference
• Installation Guides
• Usage Examples
• GitHub Actions Artifact Upload
• Distribution
• GitHub App