Installation & QuickStart

Step 1: Install Vigolium Open Source

curl -fsSL https://vigolium.com/install.sh | bash

Installs ~/.local/bin/vigolium and adds it to your shell profile. The installer verifies the SHA-256 checksum before installing.

npm install -g @vigolium/vigolium

Thin launcher that pulls the prebuilt binary for your platform as an optional dependency (Node 16+).

bun add -g @vigolium/vigolium

Installs the Vigolium launcher globally with Bun. Same prebuilt-binary launcher as the npm install path; Bun is just a faster package manager.

brew install vigolium/tap/vigolium

Installs the latest release from the Vigolium tap on macOS and Linux. Upgrade with brew upgrade vigolium.

docker pull j3ssie/vigolium:latest
docker run --rm j3ssie/vigolium:latest scan -h

The container entrypoint is the vigolium binary, pass any subcommand directly.

git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build

Requires Go 1.26+, Bun 1.3.11+, git, and make. Always use make build (not go build), it injects version metadata.

If ~/.local/bin was not already on your PATH, activate it without restarting your shell:

export PATH="$HOME/.local/bin:$PATH"

Step 2: Validate the installation

vigolium version
vigolium doctor

doctor reports any missing optional dependencies (a browser for SPA spidering, nuclei templates for the known-issue scan, bun/pi for agent drivers) and confirms your config is valid. Let it auto-install anything missing:

vigolium doctor --fix                          # auto-install/fix every failing check

--only accepts any of: nuclei, chrome, bun, claude, agent-browser, pi, piolium.

Everything Vigolium stores lives under ~/.vigolium/ (override with VIGOLIUM_HOME): config at vigolium-configs.yaml, scan DB at database-vgnm.sqlite, agent artifacts under agent-sessions/. Run vigolium init to create the workspace explicitly.

Step 3: Run a full scan

vigolium scan runs the full multi-phase pipeline (discovery → spidering → dynamic-assessment) using the balanced strategy by default:

vigolium scan -t https://example.com

Tune the depth/speed trade-off with a strategy preset:

vigolium scan -t https://example.com --strategy lite       # fast, dynamic-assessment only
vigolium scan -t https://example.com --strategy balanced
vigolium scan -t https://example.com --strategy deep       # thorough, more modules

--intensity quick|balanced|deep is a higher-level alias that also tunes the scanning profile. Not sure which mode to use? See Choosing a Scan Mode.

Step 4: One-shot stateless scan

For CI/CD pipelines, scripting, or quick ad-hoc checks where you don’t want anything left behind on disk, add --stateless and export results with -o. Vigolium spins up a temporary SQLite database, runs the requested phases, writes the output, then deletes the database on exit.

# Full pipeline, JSONL out, nothing persisted
vigolium scan --stateless -t https://example.com --format jsonl -o findings

# JSONL + HTML report, with content discovery
vigolium scan --stateless -t https://example.com --discover --format jsonl,html -o scan

# Single endpoint, no DB at all
vigolium scan-url https://example.com/api/users?id=1 -j

Multiple targets each get an isolated temp database and a per-host filename suffix so results don’t overwrite:

vigolium scan --stateless -T targets.txt --format jsonl -o results
# -> results-example.com.jsonl, results-test.example.com.jsonl, …

--stateless and --db are mutually exclusive. See Native Scan & Stateless Scanning for the full recipe book.

Step 5: Choose what to scan

# A file of targets, one URL per line
vigolium scan -T targets.txt

# From an OpenAPI / Swagger spec
vigolium scan -i api.yaml -I openapi -t https://api.example.com

# Pipe URLs from stdin
cat urls.txt | vigolium scan

# A raw HTTP request or curl command (auto-detected)
echo "curl -X POST -d 'user=admin' https://example.com/login" | vigolium scan-request

Supported input modes (-I): urls, openapi, swagger, postman, curl, burpraw, burpxml, nuclei, har. An unknown -I value is rejected with a clear error (no silent fallback).

Step 6: Pick specific modules (optional)

# Only run XSS and SQLi modules (fuzzy match on module ID/name)
vigolium scan -t https://example.com -m xss -m sqli

# Filter by tag instead
vigolium scan -t https://example.com --module-tag injection

# List everything available
vigolium -M

Step 7: Get results out

By default findings stream to the console. For files or machine-readable output, use --format with -o:

# JSONL for scripting / CI
vigolium scan -t https://example.com --format jsonl -o results

# Self-contained HTML report
vigolium scan -t https://example.com --format html -o report

# Several formats at once
vigolium scan -t https://example.com --format jsonl,html -o scan

Flag	Effect
`--format console`	Human-readable terminal output (default)
`--format jsonl` / `-j`	One JSON object per line
`--format html`	Interactive ag-grid report (requires `-o`)
`-o, --output`	Output file path (base name; extension added per format)
`--ci-output-format`	JSONL only, no banners or color, ideal for CI
`--silent`	Suppress everything except findings

Step 8: Run a single phase

Use run <phase> (an alias for scan --only <phase>) when you only want one stage of the pipeline:

vigolium run discovery -t https://example.com    # content discovery only
vigolium run spidering -t https://example.com    # browser crawl only
vigolium run dynamic-assessment -t https://example.com

Phases: ingestion, discovery, external-harvest, spidering, known-issue-scan, dynamic-assessment, extension.

A note on persistence

vigolium scan writes results to a persistent SQLite database at ~/.vigolium/database-vgnm.sqlite, so you can browse them afterward:

vigolium traffic list      # ingested HTTP records
vigolium finding list      # discovered vulnerabilities

For one-shot runs that leave nothing behind (CI, ad-hoc checks), add --stateless and export with -o. See Native Scan & Stateless Scanning for the full set of recipes.

Updating & uninstalling

vigolium update                  # update binary + nuclei templates
vigolium update --skip-templates # only reinstall the binary
vigolium update -F               # skip the confirmation prompt

Homebrew, npm, and Docker installs are upgraded through their own tooling (brew upgrade vigolium / npm update -g @vigolium/vigolium / docker pull), not vigolium update.

Next steps

Choosing a Scan Mode, pick the right mode for your job.
Native Scan & Stateless Scanning, CLI scan recipes.
Scanning Strategies, strategies, profiles, pace.
Authenticated Scanning, sessions and login flows.
Setting Up the Agent, AI-driven autopilot and swarm scans.
Configuration Reference, full configuration options.

Getting Started

Native Scan

Agentic Scan

Architecture

Native Scanning Phases

Server Mode

Customization

Others

Step 1: Install Vigolium Open Source

Step 2: Validate the installation

Step 3: Run a full scan

Step 4: One-shot stateless scan

Step 5: Choose what to scan

Step 6: Pick specific modules (optional)

Step 7: Get results out

Step 8: Run a single phase

A note on persistence

Updating & uninstalling

Next steps

​Step 1: Install Vigolium Open Source

​Step 2: Validate the installation

​Step 3: Run a full scan

​Step 4: One-shot stateless scan

​Step 5: Choose what to scan

​Step 6: Pick specific modules (optional)

​Step 7: Get results out

​Step 8: Run a single phase

​A note on persistence

​Updating & uninstalling

​Next steps

Step 1: Install Vigolium Open Source

Step 2: Validate the installation

Step 3: Run a full scan

Step 4: One-shot stateless scan

Step 5: Choose what to scan

Step 6: Pick specific modules (optional)

Step 7: Get results out

Step 8: Run a single phase

A note on persistence

Updating & uninstalling

Next steps