CLI References

A curated tour of the most common vigolium invocations, grouped by command. For the full flag list of any command, run vigolium <command> --help. For the same examples in your terminal, run vigolium --full-example.

Top-Level Commands

vigolium --help              # All available commands and global flags
vigolium <command> --help    # Flags and help for a specific command
vigolium --full-example      # Curated tour of all common usage
vigolium version             # Build and version info

The global --soft-fail flag forces an exit code of 0 even when a command fails (the error is still printed to stderr). It keeps a failing vigolium call from interrupting the wrapping script or CI pipeline:

vigolium scan -t https://example.com --soft-fail

Global flags

These work on every command (run vigolium --help for the authoritative list):

Flag	What it does
`-j, --json`	Machine-readable JSON for agent / programmatic use (compact bodies; pairs with `--fields` / `--compact` / `--full-body`)
`-v, --verbose` / `--debug`	Verbose logging / debug-level logging (debug also prints outgoing HTTP request lines)
`--silent`	Suppress everything except findings
`--dump-traffic`	Print every request/response pair to stderr, Burp-style (bypasses the logger)
`--log-file <path>`	Write all log output to a file, in JSON
`--no-color`	Disable ANSI colour everywhere (also honoured via `NO_COLOR`)
`--width <n>`	Maximum column width for table output (default `70`)
`--ci-output-format`	CI-friendly output: JSONL findings only, no colour, no banners
`--config <path>` / `--db <path>`	Override the config file / SQLite database path
`--project-uuid` / `--project-name`	Scope every operation to a project (see Projects)
`--scan-uuid <uuid>`	Pin the scan UUID for this session — use it to sync results across nodes
`--proxy <url>`	Route all requests through an HTTP/SOCKS5 proxy
`--format <list>`	Output format(s): `console`, `jsonl`, `html`, `sqlite`, `fs`
`--ext <file>` / `--ext-dir <dir>`	Load a JavaScript extension / override the extension directory
`--mem-limit <size>`	Soft heap ceiling (`GOMEMLIMIT`) for scans: empty = auto (⅓ of RAM, scaled down by `-P/--parallel`), `off`, or an explicit `6GiB` / `50%`. An existing `GOMEMLIMIT` env var wins.
`--force`	Skip confirmation prompts
`--skip-dependency-check`	Skip the first-run dependency check (chromium, nuclei templates) and stamp `~/.vigolium/initialized`
`--soft-fail`	Always exit `0` (see above)

Mistype a long flag and Vigolium suggests the nearest match instead of a bare “unknown flag” error — e.g. --module yields unknown flag: --module. Did you mean --modules? (run 'vigolium scan --help' for all flags). Added in v0.3.0.

Scanning

Run the full native pipeline against one or more targets.

# Single target
vigolium scan -t https://example.com

# Bare positional target URLs also work (deduped against -t/--target); also on scan-url/scan-request/run
vigolium scan https://example.com https://api.example.com

# Multiple targets (-t and -T/--target-file are both repeatable and combine)
vigolium scan -t https://example.com -t https://api.example.com
vigolium scan -T targets.txt
vigolium scan -T prod.txt -T staging.txt

# Scanning profiles and strategies
vigolium scan -t https://example.com --strategy deep
vigolium scan -t https://example.com --scanning-profile quick
vigolium scan -t https://example.com --scanning-profile full

# Phase control
vigolium scan -t https://example.com --only dynamic-assessment
vigolium scan -t https://example.com --skip discovery,spidering

# Module selection
vigolium scan -t https://example.com -m xss-light-url-params,sqli-error-based
vigolium scan -t https://example.com --module-tag spring --module-tag injection

# Output and reporting
vigolium scan -t https://example.com --format jsonl -o results.jsonl
vigolium scan -t https://example.com --format html -o report.html
vigolium scan -S -t https://example.com --format sqlite -o scan      # standalone .sqlite (stateless only)
vigolium scan -t https://example.com --format fs -o run             # browsable run-traffic/ + run-findings/ tree

# Print results to stdout after the scan (pairs with -S --silent; also on scan-url/scan-request/run)
vigolium scan-url -S -t https://example.com --silent --print-finding        # findings as Markdown
vigolium scan-url -S -t https://example.com --silent --print-traffic-tree   # traffic as a host/path tree
vigolium scan-url -S -t https://example.com --silent --print-traffic        # raw request/response pairs

# Network controls
vigolium scan -t https://example.com --proxy http://127.0.0.1:8080
vigolium scan -t https://example.com -c 100 --rate-limit 200
vigolium scan -t https://example.com --scanning-max-duration 2h
vigolium scan -t https://example.com --no-waf-pacing         # Disable proactive WAF/CDN pre-throttling (speed control)

# Discovery: sweep alternate HTTP(S) ports on the target hosts (deep intensity or --follow-subdomains)
vigolium scan -t https://example.com --intensity deep --port-sweep-ports 80,443,8080,8443

# CI/agent exit-code gating
vigolium scan -t https://example.com --fail-on high       # exit non-zero on any high+ finding
vigolium scan -t https://example.com --fail-on high --soft-fail   # surface the error but always exit 0

# Custom JS extensions
vigolium scan -t https://example.com --ext custom-check.js
vigolium scan -t https://example.com --ext-dir ./my-extensions
vigolium scan -t https://example.com --only extension --ext custom-check.js

# Project scoping
vigolium scan -t https://example.com --project-name my-project

# OAST and known-issue scanning
vigolium scan -t https://example.com --oast-url https://interact.sh/abc123
vigolium scan -t https://example.com --known-issue-scan-tags cve,misconfig --known-issue-scan-severities critical,high

The repeatable “opaque” flags — -H/--header, --auth, --auth-file, -t/--target, -T/--target-file, --spec-header, and --cookie — take each value verbatim: commas are literal, not separators. So a target URL with a query like ?ids=1,2,3, or a header/cookie whose value contains a comma, survives intact. To pass several values, repeat the flag (-t https://a -t https://b) rather than comma-joining them. Speed control — WAF-aware pacing. The per-host rate limiter now proactively pre-throttles a host the first time earlier-phase traffic fingerprints it behind a recognized CDN/WAF edge (CloudFront, Cloudflare, Akamai, Imperva/Incapsula, Sucuri, or Azure Front Door — detected from headers on ordinary 200s), dropping that host’s concurrency to MaxPerHost/4 and ramping back up on healthy responses. This keeps an aggressive active phase from bursting the edge into a rate-based block that would hide findings. A one-time-per-host [waf-pacing-armed] notice prints the drop (e.g. 40→10) to stderr and the session log. --no-waf-pacing disables this proactive pacing; the reactive back-off after a confirmed WAF block still applies. It’s a Speed Control flag, available on scan / scan-url / scan-request / run / ingest. Discovery — alternate-port sweep. --port-sweep-ports overrides the alternate HTTP(S) ports swept on the CLI target hosts (comma-separated). The sweep runs when --intensity deep is set or --follow-subdomains is on, so a host reachable on 8080/8443 (or any port you list) is discovered and scanned alongside the standard 80/443.

Less common scan flags

Available on scan / run (and, where relevant, scan-url / scan-request):

Flag	What it does
`--stats`	Print live progress stats while scanning
`-a, --advanced-options k=v`	Module-specific options, repeatable — e.g. `-a xss.dom=true`
`--no-clustering`	Disable deduplication of identical concurrent HTTP requests
`--stream`	Process targets as a stream, without buffering or deduplication
`--no-prefix-breaker`	Disable the per-prefix circuit breaker that stops discovery recursing into trap directories
`--known-issue-scan-exclude-tags`	Nuclei template tags to exclude (the inverse of `--known-issue-scan-tags`)
`--report-url <url>`	URL behind the “Raw Report URL” button in HTML reports (overrides `VIGOLIUM_REPORT_SHARED_URL`)
`--input-read-timeout <dur>`	Timeout for reading input from stdin or a file (default `3m`)
`--spec-default <value>`	Fallback value for required OpenAPI parameters that ship no example (default `1`)
`--required-only`	Parse only required fields from the input format, ignoring optional ones
`--skip-format-validation`	Skip validation of the input file’s format

Parallel & isolated scans

Scan many targets at once, or let several parallel scans share one database without write contention.

# Fan out a target list across N isolated child processes, one per-host output file each
vigolium scan -T targets.txt -P 4 --stateless --split-by-host --format jsonl -o results

# Parallel into one shared DB: each worker scans into a private temp DB, then merges into --db
vigolium scan -T targets.txt -P 4 --db-isolate --db shared.db --format jsonl,html -o report

# Single scan into a private temp DB merged back into --db (no write contention)
vigolium scan -t https://example.com --db-isolate --db shared.db

# Resume an interrupted stateless fan-out (skips targets that already completed)
vigolium scan -T targets.txt -P 4 --stateless --split-by-host --format jsonl -o results --resume
vigolium scan --resume                                              # auto-discover *.progress.json in cwd

-P, --parallel N — scan up to N targets concurrently as isolated child processes. Requires either -S --split-by-host (per-host outputs) or --db-isolate (merge into one --db). Real in-flight requests ≈ N × --concurrency.
--db-isolate — scan into a private temporary SQLite DB and merge results into --db at the end (SQLite only; not combinable with --stateless).
--split-by-host — in stateless multi-target mode, write a separate base-<host>.<ext> output file per target.
--resume — resume a prior -S -T --split-by-host -P run from its <output>.progress.json manifest, scanning only the targets that didn’t finish. Run bare (no other flags) to auto-discover the manifest in the current directory and relaunch the saved run.

Running a Single Phase

vigolium run <phase> is an alias for scan --only <phase>, useful when you want one specific stage of the pipeline.

vigolium run discover -t https://example.com
vigolium run spidering -t https://example.com
vigolium run dynamic-assessment -t https://example.com
vigolium run dynamic-assessment -t https://example.com --module-tag spring
vigolium run external-harvest -t https://example.com
vigolium run known-issue-scan -t https://example.com
vigolium run known-issue-scan -t https://example.com --known-issue-scan-tags cve --known-issue-scan-severities critical,high
vigolium run extension -t https://example.com --ext custom-check.js
vigolium run deparos -t https://example.com
vigolium run dast -t https://example.com

Input Modes

Feed traffic into a scan from OpenAPI, Burp, curl, HAR, or stdin.

vigolium scan -I openapi -i openapi.yaml -t https://api.example.com
vigolium scan -I burp    -i burp-export.xml -t https://example.com
vigolium scan -I curl    -i requests.txt
vigolium scan -I har     -i traffic.har
cat urls.txt | vigolium scan -i -

Run vigolium --list-input-mode to see every supported input format with examples. Accepted formats are urls, openapi/swagger, postman, curl, burpraw/raw, burpxml/burp, burpscope/burp-scope, har, nuclei, and deparos. An unknown -I/--input-mode value is rejected up front with a clear error (it previously fell through to the Nuclei parser silently, so a typo could yield zero or partial records with no warning).

-i/--input vs -T/--target-file is not a free choice. -T reads its file as one target URL per line, so a spec or an export must go through -i — pointing -T at a YAML spec makes every line of that file a target (and under -S fans out one child scan per line). The two exceptions are the formats that genuinely are target lists: urls and burpscope.

`burpscope` — scan a bug-bounty scope file

burpscope parses a Burp Suite project-config scope export — the {"target":{"scope":{"include":[…],"exclude":[…]}}} JSON a bug-bounty program hands out, not the proprietary binary .burp project file — and expands its include rules into seed URLs:

vigolium scan -T scope.json                  # content-sniffed, no -I needed
vigolium scan -i scope.json -I burpscope     # or name it explicitly

It is content-sniffed on both the -T and -i paths, so it works without -I; an explicit -I always wins. Three rules govern the expansion:

A wildcard host is never guessed at. ^.*\.example\.com$ names a set, not a server — synthesizing the apex would send traffic at a host the scope never listed. Those are reported separately rather than scanned.
An http:// candidate collapses into its https:// twin when the same host and path are in scope over both (Burp writes both for every host, and the http one is a redirect in practice). An explicit non-default port survives as its own distinct service.
Exclude rules are applied to the derived targets before anything is emitted.

A scope file that yields zero targets is a hard error, not an empty run.

Ingestion

Push HTTP traffic into the database without running a scan, useful for building a project corpus before scanning, or for sending traffic to a remote server.

vigolium ingest -t https://example.com -I openapi -i spec.yaml
vigolium ingest -t https://example.com -I burp    -i export.xml
cat urls.txt | vigolium ingest -i -

# Send to a remote Vigolium server
vigolium ingest -s http://server:9002 -i api.yaml -I openapi

Server

Start the REST API and ingest proxy.

vigolium server                                              # Default host/port from config
vigolium server --host 0.0.0.0 --service-port 8443
vigolium server --no-auth                                    # Local use only — disables bearer auth
vigolium server -t https://example.com --scan-on-receive     # Auto-scan ingested traffic (-S is shorthand for --scan-on-receive)
vigolium server -S --passive-only                            # Passive modules only — no active traffic; includes secret detection
vigolium server --mirror-fs ./mirror                         # Live-mirror ingested traffic + findings to a filesystem tree
vigolium server --burp-bridge-url http://127.0.0.1:9009      # Merge live Burp Proxy history into GET /api/http-records

# Transparent ingest proxy (records traffic flowing through it)
vigolium server --ingest-proxy-port 9003

# Intercept HTTPS too via a generated MITM CA (trust the CA printed at startup)
vigolium server --ingest-proxy-port 9003 --proxy-mitm -S
vigolium server --ingest-proxy-port 9003 --proxy-mitm --proxy-insecure   # skip upstream TLS verification

# Export the MITM CA certificate and exit (generates it if needed)
vigolium server --export-ca ./vigolium-ca.pem

# Narrowed deployments
vigolium server --view-only                                  # Read-only: no scanning, ingestion, agent, or write endpoints
vigolium server --no-agent                                   # Disable every agent endpoint (and warm-session pooling)
vigolium server --no-swagger                                 # Disable the Swagger UI and API spec endpoint
vigolium server --demo-only                                  # Expose only the demo read allowlist
vigolium server --alternative-ingest-key k1 --alternative-ingest-key k2   # Extra ingestion-only API keys

See Transparent Proxy for the full MITM workflow. Narrowing the exposed surface. --view-only is the strictest: the server answers reads and nothing else — scanning, ingestion, agent runs, and every write endpoint are refused. --no-agent keeps the scanner and ingestion but removes all /api/agent/* routes plus agent subprocess warm-session pooling (--disable-warm-session turns off only the pooling, keeping the endpoints). --no-swagger drops the Swagger UI and the spec route. --demo-only exposes just a read allowlist — GET /api/findings[/:id], /api/http-records[/:uuid], /api/modules, /api/stats, /api/extensions[/:name|/docs] — for a public demo instance. --alternative-ingest-key (repeatable) adds extra API keys accepted only on the ingestion endpoints, so a collector can push traffic without holding the main key.

--catchup-threads and --disable-catchup are deprecated no-ops kept for compatibility — catch-up scanning is disabled. They still appear in --help and in older examples.

--burp-bridge-url <url> points the server at a running Burp Suite’s loopback live bridge (default listener http://127.0.0.1:9009, exposed by the burp-vigolium extension) and merges Burp’s live Proxy rows into GET /api/http-records — labelled source: burp — for the UI and API. The flag also reads the VIGOLIUM_BURP_BRIDGE_URL env var as a fallback. See Using Vigolium with Burp Suite for bridge setup. --passive-only (with --scan-on-receive) restricts scanning to passive modules only — no active scan traffic is sent, and secret detection is included. It’s the safest way to analyze forwarded Burp/proxy traffic in place. Combining it with --full-native-scan-on-receive still crawls (discovery + spidering send requests); for zero active traffic, use --scan-on-receive without the full-native flag.

Database & Results

Browse, export, and prune scan data.

# Browse
vigolium db ls
vigolium db ls findings           # Positional table selector: findings | scans | scopes (--table is deprecated)
vigolium db stats
vigolium db stats --detailed
vigolium traffic                  # Alias for `db ls http_records`
vigolium traffic login            # Filter to login-related records
vigolium finding                  # Fuzzy-search findings
vigolium finding xss --markdown   # Render matches as Markdown (evidence + http blocks) to stdout

# Severity: --severity is an explicit set (alias --sev on `finding`); --min-severity is a floor
vigolium finding --severity high,critical                        # exactly these severities
vigolium finding --sev h,c                                       # single-letter shorthands
vigolium finding --sev crit,me,info                              # unambiguous prefixes
vigolium finding --min-severity high --confidence certain,firm   # floor (high+critical) + confidence
vigolium db ls findings --severity high,critical                 # --severity also on `db ls`

# Record kind & producing-module type (on `finding` and `db list`)
vigolium finding --record-kind finding,candidate                 # kinds: finding (default), candidate, observation
vigolium finding --module-type active,passive                    # by producing module type
vigolium db ls findings --module-type nuclei,agent               # also on `db ls`

# Exclude filters (on `finding` and `traffic`) — inverse of --search/--header/--body
vigolium finding --search sqli --exclude-search login            # keep sqli, drop anything mentioning login
vigolium traffic --exclude-header Authorization                  # drop rows carrying an Authorization header
vigolium traffic --exclude-search .css --exclude-search .js      # repeatable — drop if ANY term matches

# Read a standalone export directly (project scoping off, never writes to your DB)
vigolium finding -S --db ./scan.jsonl --min-severity high
vigolium traffic -S --db ./scan.sqlite --status 500 -n 20

# Export
vigolium export --format jsonl -o full-export.jsonl
vigolium export --format jsonl --only findings
vigolium export --format jsonl --only findings,http
vigolium export --format html -o report.html
vigolium export --format fs -o run            # browsable run-traffic/ + run-findings/ tree (also on `db export`)
vigolium export --format html,markdown,bundle -o acme-q3   # several formats, one DB read

# Live Burp bridge — read Burp history into the traffic view, or push DB traffic back into Burp
vigolium traffic --burp-bridge-url http://127.0.0.1:9009                                # merge live Burp Proxy history
vigolium traffic --burp-bridge-url http://127.0.0.1:9009 --save-to-vigolium-db          # persist the current page into the DB
vigolium traffic --burp-bridge-url http://127.0.0.1:9009 --save-to-vigolium-db --all    # persist every matching record
vigolium traffic --burp-bridge-url http://127.0.0.1:9009 --save-to-burp                 # copy DB traffic into Burp's Site map

# Cleanup — a selector is required; a bare `db clean` is rejected
vigolium db clean --scan-uuid my-scan
vigolium db clean --host api.example.com
vigolium db clean --all --force                    # delete every row from the data tables
vigolium db reset --force                          # delete + recreate the DB file (SQLite; VACUUMs automatically)

finding/traffic accept -S/--stateless + --db <file> to read a --format jsonl export or a standalone .sqlite directly, and --markdown to print the matched items as Markdown (under -S, add --compact to window long responses around the match). Severity filters. --severity (alias --sev on finding) takes an explicit comma-separated set, accepting single-letter shorthands (h,c) and any unambiguous prefix (crit, me, info). It differs from --min-severity, which is a floor — --min-severity high expands to high,critical. When both are given, --severity wins. db ls carries --severity too (findings tables). Record-kind & module-type filters. --record-kind (on finding and db list) filters by record kind — finding, candidate, or observation (comma-separated; default finding). --module-type (same commands) filters by the producing module type — active, passive, nuclei, agent, source-tools, oast, or extension (comma-separated). Exclude filters. --exclude-search / --exclude-header / --exclude-body (on finding and traffic) are the inverse of --search / --header / --body: they drop any row where the term appears. --exclude-search is repeatable, and a row is dropped if any term matches (contrast --search, whose repeated terms AND-narrow the kept set). Source, risk & remark filters. --finding-source (on finding and db list) filters findings by where they came from — dynamic-assessment, spa, agent, oast, source-tools, or extension. On db list, --min-risk <n> keeps only records whose risk score is at or above n, and --remark <text> matches text in a record’s remarks.

vigolium finding --finding-source agent          # only findings an agent run produced
vigolium finding --finding-source oast           # only out-of-band callback confirmations
vigolium db ls --min-risk 70                     # high-risk records first
vigolium db ls --remark 'admin panel'

Interactive TUI. finding, traffic, log ls, project list, and agent session all take --tui to open an interactive browser (arrow keys navigate, enter opens details, c copies the id). --no-tui forces it off — an escape hatch for scripts, in case the TUI ever becomes the default for a command. Importing findings. vigolium finding load ingests findings from JSON, JSONL, or markdown-wrapped agent output, auto-detecting the shape (an agent {"findings": [...]} envelope, a single finding object, ResultEvent JSONL, or raw database findings). It reads a positional path, --finding-file <path>, or stdin, and --scan-uuid associates the import with a scan:

vigolium finding load findings.jsonl
vigolium agent query --prompt-template review | vigolium finding load
vigolium finding load --finding-file agent-output.json --scan-uuid 6f1c2b90-8b1e-4a6c-9d2f-5c7a1e3b9d40

Live Burp bridge. With a running Burp Suite exposing the loopback bridge (default listener http://127.0.0.1:9009, from the burp-vigolium extension; env fallback VIGOLIUM_BURP_BRIDGE_URL), vigolium traffic --burp-bridge-url <url> merges Burp’s live Proxy history into the traffic view. Add --save-to-vigolium-db to persist those bridge rows into the DB (the current page, or every match with --all), or --save-to-burp to copy DB traffic into Burp’s Target Site map (the two --save-to-* flags are mutually exclusive). See Using Vigolium with Burp Suite for bridge setup. Push findings to Burp. vigolium finding --push-to-burp (paired with --burp-bridge-url) hands the selected finding(s)’ evidence request+response to Burp’s Organizer — severity-coloured, one item per finding — for manual confirmation. --to-repeater opens the finding’s request in a Repeater tab instead (Burp caps Repeater at ~30 tabs/min, so prefer --push-to-burp for a large selection), and --send-via-burp re-issues the request through Burp’s engine to capture a fresh response (with --http-mode auto|http1|http2|http2_ignore_alpn). These honour the usual finding selectors (--severity, --min-severity, a fuzzy term, --id).

# Push all XSS findings' evidence into Burp's Organizer for manual confirmation
vigolium finding xss --push-to-burp --burp-bridge-url http://127.0.0.1:9009

# Open one finding in a Repeater tab and re-issue it through Burp for a fresh response
vigolium finding --id 42 --to-repeater --send-via-burp \
                 --burp-bridge-url http://127.0.0.1:9009

Cleanup safety. A bare vigolium db clean with no selector is rejected — narrow the delete with a filter (--scan-uuid, --host, --before, --status, --severity, --search, --orphans, --findings-only, --table), use db clean --all --force to empty the data tables, or vigolium db reset --force to delete and recreate the SQLite database file from scratch (it VACUUMs automatically; without --force on a TTY it prompts for interactive confirmation).

Several export formats in one run

vigolium export --format takes a comma-separated list — html, report, pdf, jsonl, markdown (alias md), bundle (alias gz), fs. The database is read once and every format renders from that one result set, so three formats cost one query rather than three:

vigolium export --format html,markdown,bundle -o acme-q3
# → acme-q3.html
#   acme-q3.md
#   acme-q3.tar.gz

One format keeps -o verbatim. --format html -o report writes exactly report; extension-deriving only kicks in from the second format onward. Because one -o cannot name three files, it becomes required as a base path as soon as you pass a second format. An extension already on the base is replaced, not stacked.
{ts} and {project-uuid} expand once for the whole run, before per-format derivation, so every file carries the same timestamp even when a slow renderer (pdf shells out to headless Chrome) finishes seconds after its siblings.
A failing format does not discard its siblings. The error is reported inline, the run continues, and the command exits non-zero with an N of M formats failed summary. A single format still returns its bare error unchanged.

The same applies to a gs:// base — each format is uploaded under its own key. vigolium db export -f remains single-valued.

Import

Pull external scan data back into a database. The input type is auto-detected from the path.

# JSONL export (http_record + finding envelopes, e.g. from `vigolium export --format jsonl`)
vigolium import full-export.jsonl

# Audit output folder (contains audit-state.json + findings-draft/)
vigolium import ./audit-output/

# Merge another vigolium SQLite scan DB into your default database
vigolium import other-vigolium-scan.sqlite

# Merge into an explicit destination (--db is the target)
vigolium import --db team.sqlite other-vigolium-scan.sqlite

# Combine many standalone scan DBs into one (idempotent — re-runs are no-ops)
for f in scans/*.sqlite; do vigolium import --db combined.sqlite "$f"; done

# Compressed archive (.tar.gz / .tgz / .zip) or a cloud-storage object
vigolium import ./scan-bundle.tar.gz
vigolium import gs://<project-uuid>/imports/scan.tar.gz

# One-shot persist of a running Burp Suite's live Proxy history into the DB
vigolium import --burp-bridge-url http://127.0.0.1:9009

--burp-bridge-url <url> turns import into a one-shot persist of all of a running Burp’s live Proxy history into the database (default listener http://127.0.0.1:9009; env fallback VIGOLIUM_BURP_BRIDGE_URL). It’s an import source, so it cannot be combined with path arguments or --glob-db. See Using Vigolium with Burp Suite. Report metadata. When import / export render an HTML report, three flags fill in header fields the source data can’t supply: --report-url <url> sets the target of the report’s “Raw Report URL” button (overriding VIGOLIUM_REPORT_SHARED_URL; also available on scan / run), --report-duration "10h42m5s" states the scan duration, and --report-generated-at 2026-08-01T03:00:00Z stamps the generation time. import --upload pushes the artifact to cloud storage, with --upload-key overriding the default imports/<basename>-<ts>.<ext> object key. A SQLite database input (detected by its magic header, any extension) is a lossless, idempotent SQLite→SQLite merge: HTTP records, findings, scans, agentic scans, OAST interactions, and projects are deduped on their natural keys, and each row keeps its original project. Re-importing the same database adds nothing the second time. The destination is the --db target (or the configured default database when --db is omitted). Add -j/--json to print a per-table merge summary (rows inserted vs. skipped). This pairs with scan -S --format sqlite: fan out per-host .sqlite files, then merge them back into one queryable DB.

Replay

Re-send stored traffic — verbatim, or with an exact-byte override — to confirm a finding or push a whole corpus back through a proxy. For payload / insertion-point fuzzing, reach for vigolium fuzz instead (replay’s -m/--mutate was removed). The banner is suppressed so bulk output stays pipe-clean.

# Re-send a stored record and diff the fresh response against the baseline
vigolium replay --record-uuid abc12345

# Re-fire the exact request behind a finding (human-readable summary)
vigolium replay --finding-id 42 --pretty

# Send exact bytes verbatim — a hand-edited raw request overrides the resolved baseline
vigolium replay --record-uuid abc12345 --raw-request-file exact.txt

# Replay a curl command verbatim (auto-baseline by re-sending)
vigolium replay -i "curl -X POST https://example.com/api/login -d 'u=admin'"

# Multi-step auth via a persistent cookie jar
vigolium replay --session-id login -i curl-login.sh
vigolium replay --session-id login --record-uuid <action-uuid>
vigolium replay --record-uuid <uuid> --no-cookies   # send with no cookies (overrides --session-id)

# Confirm against a different environment than the baseline
vigolium replay --record-uuid abc12345 --target https://staging.example.com \
                 -H 'X-Forwarded-For: 127.0.0.1'

# Merge headers from a saved auth session (from `vigolium auth list`)
vigolium replay --record-uuid abc12345 --target https://staging.example.com \
                 --auth-session my-session

# Save a replayed request + its fresh response back into Burp's Target Site map
vigolium replay --record-uuid abc12345 \
                 --burp-bridge-url http://127.0.0.1:9009 --save-to-burp

# Send the exact bytes through Burp's OWN HTTP engine (not Go's client) — force HTTP/1 for desync
vigolium replay -i req.txt --burp-bridge-url http://127.0.0.1:9009 \
                 --send-via-burp --http-mode http1

# Stage the request in a Burp Repeater tab, or store request+response in the Organizer
vigolium replay --record-uuid abc12345 --burp-bridge-url http://127.0.0.1:9009 --to-repeater
vigolium replay --record-uuid abc12345 --burp-bridge-url http://127.0.0.1:9009 \
                 --to-organizer --notes 'IDOR candidate' --highlight orange

Exact-byte override. --raw-request <string> sends those exact bytes instead of the resolved baseline — for a hand-crafted smuggling prefix, a deliberate Content-Length, or an unusual method; --raw-request-file <path> reads the same from a file (the two are mutually exclusive). -i/--input (curl / raw HTTP / Burp) likewise replaces the whole request. For wordlist-scale payload injection at an exact position, use vigolium fuzz. --save-to-burp (paired with --burp-bridge-url) adds each replayed request and its fresh response straight into Burp’s Target Site map — without proxying it twice — so a confirmed exploit lands back in Burp for manual follow-up (default listener http://127.0.0.1:9009; env fallback VIGOLIUM_BURP_BRIDGE_URL). See Using Vigolium with Burp Suite. Send through Burp’s engine. --send-via-burp routes the send through Burp’s own HTTP stack so the exact bytes reach the wire — a deliberate Content-Length, a smuggling prefix, or an unusual method is preserved instead of being normalised by Go’s client. Pick the wire protocol with --http-mode auto|http1|http2|http2_ignore_alpn (default auto; use http1 for request smuggling / desync so auto doesn’t renegotiate HTTP/2 and reframe the request). Independently, --to-repeater (with --repeater-tab <name>, default vigolium) stages the request in a Burp Repeater tab, and --to-organizer (with --notes and --highlight) stores the request + response pair in Burp’s Organizer. All require --burp-bridge-url; without them the send path is unchanged. See Send traffic through Burp’s engine.

Bulk replay

A positional vigolium replay <term> does a broad fuzzy match over stored traffic (URL, path, host, method, content-type, source, and the raw request/response) — exactly like vigolium traffic <term> — and switches replay into “iterate every matching stored record” mode. Passing --all or any selector flag does the same. Each matched record is re-sent verbatim through the diff engine, streaming one JSONL object per record with per-record error isolation.

# Replay every stored request whose text matches "admin" through a proxy (5 at a time)
vigolium replay admin --proxy http://127.0.0.1:8080 -c 5

# Replay ALL stored traffic through a proxy (JSONL out)
vigolium replay --all --proxy http://127.0.0.1:8080 -c 5

# Traffic-style selectors: POST records containing "token" but not "logout"
vigolium replay --host api.example.com --method POST --search token \
                 --exclude-search logout --proxy http://127.0.0.1:8080 -c 5

# Date range + ordering: JSON 200s since a date, oldest-sent first
vigolium replay --status 200 --body 'application/json' --from 2026-07-21 \
                 --sort sent_at --asc -c 5

# Replay every record from a standalone export (project scoping off)
vigolium replay -S --db scan.sqlite --all --proxy http://127.0.0.1:8080 -c 5

The selection surface mirrors vigolium traffic:

Match: a positional term, repeatable --search (AND-combined; matches URL/path and the raw request/response), --host, --method (repeatable), --status (repeatable), --path, --source, --body.
Exclude: repeatable --exclude-search and --exclude-body drop matching records.
Range & order: --from / --to (see Date filtering for the accepted forms), --sort uuid|created_at|sent_at|method|status|time (default created_at), --asc (default: newest-first), --offset <n> for pagination.
--all lifts the default -n/--limit cap (100); narrow the set with the selectors instead. Each record is re-sent verbatim — payload / insertion-point fuzzing lives in vigolium fuzz.
Throttle with -c/--concurrency (default 10); cap the set with -n/--limit (default 100, lifted by --all).
Combine with --proxy, --save-to-burp, or --send-via-burp as with single-record replay.
-S/--stateless --db <file> reads baselines from a standalone .sqlite/.jsonl export with project scoping off — it never writes to your project DB.

Replay through a real browser

--with-browser loads each matched record’s URL in a real browser routed through --proxy, instead of re-sending the stored bytes. Use it when an intercepting proxy needs genuine browser traffic — real TLS fingerprint, JS execution, and subresource loads — rather than a replayed byte stream:

vigolium replay --host acme.test --all --with-browser --proxy http://127.0.0.1:8080

This is not a diff mode. A navigation exposes no status code and no response body, so there is nothing to compare against the baseline. Those runs emit a browser object — requested_url, final_url, title, dialogs, and original_method when the record’s method wasn’t GET (a navigation can only issue a GET) — and leave result null, rather than a hollow summary whose zero-valued status would read as a real comparison.

Because nothing is re-sent, --with-browser is rejected alongside every flag downstream of the send: --in-replace, --raw-request, and the Burp send/stage targets. Without --proxy it warns — browser traffic isn’t being routed anywhere to be captured.

Date filtering

--from / --to (aliases --since / --until) are available on finding, traffic, db ls, db export, and replay, all sharing one parser. db clean --before and swarm’s --records-from since=|until= accept the same forms:

Form	Examples
Relative offset	`2d`, `12h`, `30m`, `1w`, compound `1h30m`, optional trailing `ago`
Named	`today`, `yesterday`, `now`
Date	`YYYY-MM-DD`
Date + wall-clock time	`YYYY-MM-DD HH:MM[:SS]`
Absolute	RFC3339

vigolium finding --since 2d --min-severity high     # last two days
vigolium traffic --from today                       # since local midnight
vigolium traffic --from 2026-08-01 --to 2026-08-01  # the whole of Aug 1
vigolium db ls --since '1h30m ago'

Two behaviours are worth knowing. Bare dates and wall-clock times resolve in your local zone — resolving them as UTC would silently drop the first hours of the local day, and --since today is the flag’s whole point. And a bare date on an upper bound snaps to end-of-day, so --from D --to D is the full day D rather than an empty range. An inverted range is a hard error, not silently-empty output.

db clean --before deliberately does not snap to end-of-day, so the named day survives the delete.

Fuzz

vigolium fuzz injects a caller-supplied payload set into chosen positions of one request and streams per-payload response signals (status, size, words, lines, time, reflection, baseline-delta) with match/exclude gating and auto-calibration against the target’s catch-all. It is a low-level primitive, not a scanner: it sends exactly the payloads you give it at exactly the positions you pick and makes no vulnerability decision — it emits raw signals, not findings. The intelligence comes from the caller (typically a coding agent). For confirmation-backed detection of known classes, use the module scanner instead: vigolium scan-request -i req.txt -m xss,sqli -j.

# Fuzz a wordlist into a FUZZ marker; keep only 200s
vigolium fuzz 'https://acme.test/api/FUZZ' -w dir-short --match-status-code 200

# Inject a built-in payload class into one parameter; anomalies vs the calibrated baseline
vigolium fuzz 'https://acme.test/item?id=1' --point URL_PARAM:id --class sqli,xss

# Fuzz from a raw request on stdin with inline payloads; drop 404s
cat req.txt | vigolium fuzz -p "' OR 1=1--" -p '<svg/onload=alert(1)>' --exclude-status-code 404

# Fuzz a stored record (by UUID) as the baseline request
vigolium fuzz -u <record-uuid> --fuzz params -w fuzz

# Agent handle: stream JSONL to stderr, print ONE summary object to stdout
vigolium fuzz 'https://acme.test/api?id=FUZZ' -w ~/wordlists/ids.txt -j

# Let the run tell you what's interesting instead of writing matchers
vigolium fuzz 'https://acme.test/api/FUZZ' -w dir-short --anomaly

# Credential pairs in lockstep across two markers
vigolium fuzz 'https://acme.test/login' -X POST -d 'u=FUZZ&p=FUZZ2' \
  --mode pitchfork -w users.txt:FUZZ -w passwords.txt:FUZZ2

# CI/agent gate: exit non-zero (3) if any result matches
vigolium fuzz 'https://acme.test/admin/FUZZ' -w dir-short --match-status-code 200,301 --fail-on-match

Source (one of): a positional URL (with -X/--request, -H/--header, and -d/--data to build the method, headers, and body), -i/--input (curl, raw HTTP, Burp XML, base64, URL, or - for stdin; --input-file reads that same value from a file), -u/--record-uuid (a stored HTTP record), or a request piped on stdin. -t/--target overrides the scheme/host/port the request is actually sent to. -X, -H, and -d apply to every source, not just a positional URL, and are applied before positions are resolved — so a marker introduced by -H 'X-Forwarded-For: FUZZ' is discovered. Positions (what to fuzz): a literal FUZZ marker anywhere in the request (request line, path, header, or body) wins if present; otherwise --fuzz method|path|params|param-name|headers|cookies|all (default: all discovered insertion points), --point TYPE:name (e.g. URL_PARAM:id, repeatable), or --fuzz-header <name> (repeatable). --fuzz-header injects a header the request doesn’t already carry rather than erroring — X-Forwarded-For is interesting precisely because the client never sends it. The marker keyword is configurable with --keyword. Payloads (combine freely): --class selects a built-in vulnerability class — xss, sqli, ssti, ssrf, lfi, path_traversal, xxe, cmdi, open_redirect, crlf (aliases like traversal, rce, sql, template accepted); -w/--wordlist takes a builtin name (fuzz, dir-short, dir-long, file-short, file-long) or a file path (repeatable); -p/--payload adds an inline literal (repeatable). Attack modes (--mode). Numbered markers FUZZ, FUZZ2, FUZZ3… become separate positions, and -w users.txt:FUZZ binds a wordlist to one of them:

Mode	Behaviour
`sniper` (default)	One position at a time, the others left at their original value
`batteringram`	The same payload placed in every position at once
`pitchfork`	Lists advance in lockstep — credential pairs, bounded by the shortest list
`clusterbomb`	Every combination of every list

Multi-position modes are marker-only: an httpmsg insertion point is built against the request it was analyzed on, so applying a second would discard the first’s edit. Clusterbomb expansion is bounded, so a runaway product is a clear error rather than an out-of-memory kill. Matchers & excludes. Matchers keep a response (OR-combined; empty keeps all): --match-status-code (accepts all), --match-size, --match-words, --match-lines, --match-regex, --match-time (ms), --match-time-z, and --match-header. Each has an --exclude-* counterpart that drops a response. --match-mode all requires every category instead of any (likewise --exclude-mode). Numeric flags take a comparison predicate, not just exact equality — N, N-M, >N, >=N, <N, <=N, !N, comma-separated. Exact equality alone is near-useless for sizes, since a page carrying a timestamp or CSRF token is never byte-identical twice:

--match-status-code 200,301   --match-size '>1000'    --match-words 50-80
--match-lines '!0'            --match-time '>500'     # bare N on --match-time means >=N
--match-header 'Location: /admin'                     # presence-only: --match-header Location

--match-header matches response headers — header reflection is the whole signal for open redirect and response splitting. Reflection is likewise reported as reflected_raw (verbatim) separately from an escaped echo, with reflected_in naming the location (body, header:Location), because conflating a verbatim echo with an HTML-escaped one hides the difference between “this might execute” and “the app escaped it”. Auto-calibration (on by default) probes the target’s wildcard/catch-all and suppresses matches identical to it — suppressed results carry "calibrated":true; disable it with --no-calibrate. Anomaly scoring (-a/--anomaly) is the alternative to writing matchers by hand. Writing a matcher means knowing the interesting size or status up front; instead, each response is scored against the baseline and against the run’s own population, and the ones that stand out are kept:

vigolium fuzz 'https://acme.test/api/FUZZ' -w dir-short --anomaly --anomaly-threshold high

The population reference is what makes this work on an unknown target — a status change that every payload triggers is the endpoint’s normal behaviour, not a signal, and only rarity distinguishes those. Signals include a leaked SQL/stack/template error the baseline lacked, a 5xx, a 4xx→2xx flip (auth-bypass-shaped), size and time outliers, a body no other payload produced, a rare status, a changed Location/WWW-Authenticate, and unencoded reflection. Outliers use median-absolute-deviation rather than standard deviation, since a fuzz population is full of outliers by construction and they would inflate a stddev enough to hide themselves. Every result carries anomaly_score and anomaly_reasons. --anomaly-threshold low|medium|high (or a number) sets the bar; --anomaly-min-population (default 12) is how many responses must land before rarity and outlier signals count. With --anomaly and no explicit matchers, “interesting” replaces “keep everything” as the gate.

Anomaly scoring reports where to look, never a verdict — the primitive stance holds. Confirm a lead with the module scanner: the -j summary hands you a ready scan-request query for exactly that.

Baseline timing. --baseline-samples N sends the un-fuzzed request N times to measure timing jitter, giving each result a time_z (standard deviations above the baseline mean) that --match-time-z can gate on. Default is 1, or 3 under --anomaly. This is how to express a time-based signal without guessing a per-target millisecond threshold. Curl parity. fuzz accepts curl’s long-form flags so a request pasted from DevTools works with minimal editing: --cookie, --user, --user-agent, --referer, --data-raw, --data-binary, --data-urlencode, --form, --form-string, --get, --head, --insecure, --cacert, --cert, --key, --max-redirs, --connect-timeout, --max-time, --compressed, --http1.1, --http2, --resolve, --path-as-is. Long forms only — the short spellings are already taken by vigolium meanings (-u record UUID, -i input, -w wordlist, -c concurrency). Body assembly is shared with the curl input parser, so --data-urlencode and --form behave identically whether they arrive as flags or inside a pasted curl command. --auth-session / --session-id / --no-cookies mirror replay. Dry run. --dry-run resolves positions and payloads and prints the exact bytes each would send, with zero network traffic — the pre-flight to run before committing to a wordlist-scale job. --ignore-scope overrides the project-scope guard when the target is outside configured scope. Output. Default is JSONL (one object per send) to stdout — matched-only unless --all-results; --pretty renders a human-readable table, -o/--output writes to a file. Under -j/--json, the JSONL streams to stderr and a single summary object prints to stdout: {target, sent, matched, calibrated, baseline, top_results (ranked anomalies), query (a ready scan-request confirmation)} — a handle a coding agent can act on directly. --fail-on-match exits 3 when any result matches, for CI/agent gating. Throttle with -c/--concurrency (default 10) and --delay <ms>; --timeout sets the per-request timeout and --no-redirects stops following 30x. Honors HTTP_PROXY/HTTPS_PROXY for Burp inspection. Send through Burp’s engine. --send-via-burp (with --burp-bridge-url) routes every payload through Burp’s own HTTP stack so exact bytes hit the wire — the way to fuzz malformed/smuggling requests (pair with --http-mode http1); --matches-to-organizer pushes each matched request into Burp’s Organizer for triage. See Send traffic through Burp’s engine.

replay’s -m/--mutate flag was removed — replay now re-sends stored traffic (verbatim, or with an exact-byte --raw-request override) and confirms, while fuzz owns wordlist-scale payload injection at an exact position. (The pkg/replay library and the agent’s in-process replay_request tool still apply mutations.)

Strategies & Phases

Inspect scanning strategy presets and the phases that make up a scan.

vigolium strategy          # strategies, intensities, phases, and agent modes
vigolium phase             # alias for `vigolium strategy`

Modules

Manage the active and passive scanner modules.

vigolium module ls
vigolium module ls xss             # Search by keyword (matches id, name, description, or tag)
vigolium module ls --type active   # Active or passive only
vigolium module ls --list-enabled  # Only modules currently enabled in your config
vigolium module ls --tags          # Dump every unique module tag
vigolium module ls xss -v          # Long descriptions + confirmation criteria
vigolium module enable xss
vigolium module enable sqli-error-based --id   # Exact module ID instead of fuzzy match
vigolium module disable sqli
vigolium scan -M                   # List all modules from the scan command

Module IDs carry no active- / passive- prefix — the id in vigolium module ls is exactly what -m / --module-id expects. See the Scanner Modules Reference for the full table.

Skills

Install the coding-agent skill bundles shipped inside the binary (so they always match your CLI version) into a coding agent’s skills directory. See Using Vigolium in your agent.

vigolium skills                                   # List bundled skills (alias: vigolium skills list)
vigolium skills get vigolium-scanner              # Print a bundle without installing it
vigolium skills install                           # Install vigolium-scanner for Claude into the current project
vigolium skills install --agent codex --scope global   # --agent claude|codex|agents, --scope project|global
vigolium skills install --all                     # Install every bundled skill
vigolium skills install --dir ./.claude/skills    # Override the destination directory
vigolium skills get vigolium-scanner --full       # Include the reference files, not just SKILL.md
vigolium skills get --all                         # Output every bundled skill

An already-installed skill is skipped unless --force is given. Because the content is embedded in the binary it always matches the installed version — prefer vigolium skills install over copying stale files by hand.

Extensions

Run and manage JavaScript extensions that hook into the scanner.

vigolium ext ls
vigolium ext docs
vigolium ext preset
vigolium ext example                       # Print every example extension (all supported formats)
vigolium ext example --list                # Just the catalog index (keys + titles)
vigolium ext example js-active-insertion   # Print a single example by its catalog key
vigolium ext example --lang yaml           # Restrict to one language
vigolium ext eval 'vigolium.log("hello")'
vigolium ext eval --ext-file script.js

# Run ad-hoc JavaScript against the full vigolium.* API
echo 'vigolium.log(vigolium.payloads("xss").length)' | vigolium js
vigolium js --code 'vigolium.log("hello")'
vigolium js --code-file script.js --target https://example.com --timeout 60s

vigolium js executes a script with the whole vigolium.* API in scope. It reads stdin by default; --code takes an inline string and --code-file a .js/.ts path. --target seeds the TARGET variable, --timeout bounds execution (default 30s), and --format json|text picks the output shape.

Scope

Control what’s in-scope. Source code is attached per scan via the --source flag on vigolium agent <subcommand> (autopilot, swarm, query, audit).

vigolium scope view
vigolium scope set host.include '*.example.com'

Agent (AI)

Run agentic and source-audit modes. See Agent Mode for the full list of subcommands.

`agent query`: single-shot prompts

vigolium agent query --source ./src --prompt-template security-code-review
vigolium agent query --source ./src --prompt-template endpoint-discovery
vigolium agent query 'review this code for vulnerabilities'
vigolium agent query --agent-label code-review --prompt-file custom-prompt.md
vigolium agent --list-templates

`agent triage`: confirm or retire one finding

vigolium agent triage 42                      # triage finding id 42
vigolium agent triage 42 --max-duration 10m
vigolium agent triage 42 --dry-run            # render the prompt, don't call the agent or write
vigolium agent triage 42 --show-prompt -v     # print the prompt, show per-tool result previews

Picks one stored finding and asks an agent whether it’s real. The agent reads the finding’s description and captured request/response, may re-probe the live target with its HTTP tool, and writes back a verdict plus reasoning. A false_positive verdict downgrades the finding’s severity to info and appends the reasoning to its description, so the original detection context survives. --max-duration defaults to 5m (0 = no limit). It takes the same olium provider overrides as the other agent subcommands.

`agent swarm`: AI-guided multi-phase scan

vigolium agent swarm -t https://example.com --discover
vigolium agent swarm -t https://example.com --discover --prompt 'focus on API injection'

# Natural-language positional prompt — preserved as extra instruction context alongside flags
vigolium agent swarm "focus on the checkout and payment flows" -t https://example.com --discover

# Load prose guidance plus raw HTTP request seeds from one plan file
vigolium agent swarm -t https://example.com --plan-file ./pentest-plan.md

# Run browser-based login; describe credentials and roles in the prompt
vigolium agent swarm -t https://example.com --browser-auth \
  --prompt "log in as admin/admin123, then compare the user role"

# Skill control (force-load attack-vector skills, bypass planner selection)
vigolium agent swarm -t https://example.com --discover --skill-tag xss,idor
vigolium agent swarm -t https://example.com --discover --no-skill-filter

# Olium provider/model overrides (same set as `agent autopilot` / `agent query`)
vigolium agent swarm -t https://example.com --discover --provider anthropic-api-key --model claude-opus-4-7
vigolium agent swarm -t https://example.com --discover --base-url http://localhost:11434/v1 --llm-api-key "$KEY"

# Plan from traffic already in the project DB instead of discovering
vigolium agent swarm -t https://example.com --all-records
vigolium agent swarm -t https://example.com \
  --records-from "host=example.com,status=200,method=POST,path=/api,since=2026-07-01"

agent swarm accepts the olium override flags --provider, --model, --base-url, --llm-api-key, --oauth-cred, and --oauth-token; each falls back to agent.olium.*. For the Vertex providers, --gcp-project and --gcp-location set the GCP project and region (falling back to $GOOGLE_CLOUD_PROJECT / $GOOGLE_CLOUD_LOCATION, then agent.olium.google_cloud_*, then us-central1). --prompt and the positional [prompt] are the same task-guidance slot and stay verbatim when structured target/source flags are also present. Choosing the input records. Without --discover, swarm plans from the traffic it’s given: --all-records uses every HTTP record in the active project, and --records-from filters them by a spec string (host=, path=, method=, status=, source=, since=, until=, comma-separated — since/until take the shared date grammar). --max-plan-records caps how many reach the plan agent — it selects the most interesting with one slot per URL prefix, and --intensity overrides the default (quick 10, balanced 25, deep 50; 0 = no limit). Tuning the run. --probe-concurrency (default 10), --probe-timeout (default 10s), and --max-probe-body (default 2 MB) bound the probing stage; --sub-agent-concurrency (default 3) caps parallel source-analysis sub-agents (routes, auth, extensions); --max-master-retries (default 3) is how many times a master-agent parse failure is retried. --disable-guardrail skips the prompt-safety classifier on the natural-language prompt — use it only when a known-good prompt is being refused.

`agent autopilot`: autonomous agentic scan

# Natural-language prompt — target, source, and focus auto-extracted
vigolium agent autopilot "scan VAmPI source at ~/src/VAmPI on localhost:3005"
vigolium agent autopilot "test auth bypass on https://app.example.com"

# Plain target
vigolium agent autopilot -t https://example.com/api

# Source-aware (auto-runs vigolium-audit first to build context)
vigolium agent autopilot -t https://example.com --source ./src
vigolium agent autopilot -t https://example.com --source ./src --audit=off   # disable vigolium-audit

# Pipe a curl command or raw HTTP request via stdin
curl -s https://example.com/api/users | vigolium agent autopilot
cat request.txt | vigolium agent autopilot -t https://example.com

# Pass curl/raw HTTP as input
vigolium agent autopilot --input "curl -X POST -H 'Content-Type: application/json' \
  -d '{\"user\":\"admin\"}' https://example.com/api/login"

# Focus the agent on specific vulnerability classes
vigolium agent autopilot -t https://example.com --prompt "focus on auth bypass and IDOR"

# Skill control — force-load skills by name or tag, or skip pre-flight selection
vigolium agent autopilot -t https://example.com --skill idor-blast-radius
vigolium agent autopilot -t https://example.com --skill-tag xss,idor
vigolium agent autopilot -t https://example.com --no-skill-filter

# Intensity presets — quick (CI/PR), balanced (default), deep (pentest)
vigolium agent autopilot -t https://example.com --intensity deep
vigolium agent autopilot -t https://example.com --source ./src --intensity quick

# Narrow source scope
vigolium agent autopilot -t https://example.com --source ./src \
  --files "routes/api.js,controllers/auth.js" \
  --prompt "Focus on the new payment endpoint"

# PR / diff-aware scan
vigolium agent autopilot -t https://example.com --source ./src --diff "main...feature-branch"
vigolium agent autopilot -t https://example.com --source ./src --last-commits 3

# Backend and authenticated testing (browser is always available)
vigolium agent autopilot -t https://example.com --provider anthropic-api-key
vigolium agent autopilot -t https://example.com \
  --prompt "log in as admin/admin123, then test protected routes"

# Mine existing project/Burp traffic and supply application documentation
vigolium agent autopilot -t https://example.com --prior-context auto
vigolium agent autopilot -t https://example.com \
  --burp-bridge-url http://127.0.0.1:9009 --knowledge-base ./app-docs

# Durable-mode resume and explicit debug artifacts
vigolium agent autopilot --resume <agentic-scan-uuid> \
  --prompt "continue the remaining checks"
vigolium agent autopilot -t https://example.com \
  --session-dir ./debug/run-1 --transcript ./debug/run-1.jsonl

# Limits and previews
vigolium agent autopilot -t https://example.com --intensity deep --max-duration 4h
vigolium agent autopilot -t https://example.com --intensity quick --triage
vigolium agent autopilot -t https://example.com --source ./src --dry-run
vigolium agent autopilot -t https://example.com --source ./src --show-prompt

Autopilot and swarm no longer expose CLI flags named --focus, --instruction, --instruction-file, --browser, or --credentials. Put those details in --prompt. The REST agent endpoints keep structured equivalents for API clients. Knowledge base. --knowledge-base <file|dir> front-loads operator-supplied docs about the app. Prose (markdown / txt / rst) is LLM-distilled into a compact brief plus a document index, with the full documents left on disk for the agent to read on demand. HTTP-traffic exports found in the same path — HAR, Burp XML, curl, OpenAPI/Swagger, Postman, URL lists, raw HTTP — are auto-detected, parsed, and ingested into the project database as normal traffic (source=knowledge-base), with a sample folded into the brief. So a knowledge base can seed the agent with real requests, not just prose. --knowledge-base-no-traffic turns that off and treats every file as prose; --knowledge-base-raw skips the LLM distillation and inlines the deterministic index only (offline / reproducible runs). Both are no-ops without --knowledge-base. Other autopilot controls. --disable-guardrail skips the prompt-safety classifier on the natural-language prompt (only when a known-good prompt is being refused). --post-halt-gap-threshold <n> sets how many new (method, URL) routes the post-halt probe must turn up before the agent is re-entered (0 = the built-in default of 5).

`agent audit`: unified source audit (vigolium-audit + piolium)

Runs the vigolium-audit harness and/or piolium against a single source tree under one AgenticScan, with per-driver session subdirs and a post-pass findings dedup. vigolium-audit is the embedded harness name; the CLI driver value is audit.

# Default driver is "auto": run audit; fall back to piolium only if the
# claude/codex CLI required by audit is missing. Balanced mode.
vigolium agent audit --source .

# Run both drivers back-to-back, unconditionally
vigolium agent audit --driver both --source ./backend

# Single driver — piolium only (no audit, no fallback)
vigolium agent audit --driver piolium --source ./backend --mode lite
vigolium agent audit --driver audit   --source ./backend --agent claude

# Multi-driver, deep intensity, against a remote git URL
vigolium agent audit --driver both --source [email protected]:org/repo.git --intensity deep
vigolium agent audit --driver both --source https://github.com/org/repo.git --commit-depth 0   # full history

# Override pi's provider/model for the piolium leg
vigolium agent audit --driver both --source ./backend \
  --pi-provider vertex-anthropic --pi-model claude-opus-4-6

# Driver-specific modes (piolium=longshot/smoke, audit=mock)
vigolium agent audit --driver piolium --source ./mono-repo --mode longshot \
  --plm-longshot-langs python,go --plm-longshot-limit 200
vigolium agent audit --driver audit --source ./backend --mode mock

# Cap commit-history scan window (piolium only)
vigolium agent audit --driver piolium --source ./backend --plm-scan-since "60 days ago"
vigolium agent audit --driver piolium --source ./backend --plm-scan-limit 500

# Skip post-pass dedup or preflight checks
vigolium agent audit --source ./backend --no-dedup
vigolium agent audit --source ./backend --no-preflight

# Pull source from a cloud-storage archive, upload results when done
vigolium agent audit --source gs://my-bucket/snapshots/repo.tar.gz
vigolium agent audit --source ./backend --upload-results

# Stateless one-shot: run into a throwaway DB and auto-render a self-contained HTML report
vigolium agent audit --source ./backend -S

# Bundle the HTML report + each ran driver's raw vigolium-results/ tree into one folder
vigolium agent audit --driver both --source ./backend -S --output-dir ./audit-bundle

On agent audit, --intensity deep resolves to the deep,confirm mode chain (the modes run back-to-back), matching the POST /api/agent/run/audit endpoint; quick maps to lite and balanced to balanced (both single-mode). -S/--stateless runs the whole audit into a throwaway temp DB (your main DB is untouched, mirroring scan -S) and, on completion, renders a self-contained HTML report from the run’s findings to vigolium-result/vigolium-audit-report.html (override with -o/--output, which supports gs:// and {ts}). --output-dir <dir> (stateless-only) additionally bundles that report and a copy of each ran driver’s raw vigolium-results/ tree into one folder — a single driver lands flat at <dir>/vigolium-results/, multiple are namespaced under <dir>/<driver>/. -S is rejected with --interactive. --keep-raw is on by default for the CLI (it retains the <source>/vigolium-results/ copy); --clean-raw removes that source copy after the run. Bring-your-own-key (audit leg). Three mutually exclusive flags supply credentials for the run without touching your config; each accepts a literal value, $ENV_NAME, or @path:

vigolium agent audit --source ./backend --api-key '$ANTHROPIC_API_KEY'
vigolium agent audit --source ./backend --oauth-token @~/.claude/setup-token
vigolium agent audit --source ./backend --agent codex --oauth-cred-file '$CODEX_AUTH'

--api-key — API key for the resolved agent (claude → ANTHROPIC_API_KEY, codex → OPENAI_API_KEY). Empty inherits agent.olium.*.
--oauth-token — Anthropic OAuth bearer token, Claude only (produced by claude setup-token).
--oauth-cred-file — OAuth credential file (Codex ~/.codex/auth.json shape). For piolium runs it’s staged under the pi agent dir with backup-and-restore.

Run controls. --show-thinking renders the agent’s internal thinking blocks in the live stream (off by default — they’re verbose). --preflight-timeout <dur> bounds the per-driver preflight check (default 30s, applies to both pi and claude). The piolium retry knobs are --plm-phase-retries, --plm-command-retries, and --plm-longshot-timeout (per-file kill timer in ms, longshot mode); 0 on any of them means “use piolium’s own default”.

`log`: replay an agentic session

Every olium agent run (autopilot, swarm, query, olium) writes a Pi-compatible transcript.jsonl. Replay it as a rendered conversation, or dump the raw JSONL:

vigolium log                       # Replay the most recent agentic session
vigolium log <session-id>          # Replay a specific session
vigolium log --raw                 # Print the raw transcript JSONL verbatim instead of the rendered replay
vigolium log --strip-ansi > run.txt   # Strip ANSI colour codes (for piping into a file or another tool)

Configuration

vigolium config ls
vigolium config ls server             # Filter by a key prefix
vigolium config ls '*burp*'           # Filter keys by glob
vigolium config view 'notify.*'       # Print a subtree
vigolium config ls --show-secrets     # Reveal masked secret values (API keys, tokens) in plaintext

# Set individual keys by dotted path — missing nested sections are created automatically
vigolium config set server.enable_burp_bridge true
vigolium config set server.burp_bridge_url http://127.0.0.1:9009
vigolium config set notify.enabled true
vigolium config set notify.provider telegram
vigolium config set notify.severities high,critical      # coerced to a list
vigolium config set notify.telegram.bot_token <bot-token>
vigolium config set notify.telegram.chat_id <chat-id>
vigolium config set database.driver postgres

vigolium config clean
vigolium init                     # Initialize ~/.vigolium with defaults
vigolium doctor                   # Diagnose configuration and tool readiness
vigolium auth                     # Authentication management utilities
vigolium project                  # Manage multi-tenant projects

vigolium config ls (aliases list / view) redacts sensitive values — API keys, tokens, credentials — as [redacted] by default. Pass --show-secrets to reveal them in plaintext; it prints a warning to stderr. The generic -F/--force no longer reveals secrets (it only skips confirmation prompts). Both accept an optional key prefix or glob (config ls server, config view 'notify.*') to print just a subtree. vigolium config set <key> <value> takes a dotted path and creates missing intermediate sections, so a previously-unset nested key — notify.telegram.bot_token, server.burp_bridge_url, server.enable_burp_bridge — can be set directly instead of failing with “key not found”. The value is coerced to the field’s declared type (bool / int / float / comma-separated list), and the key is validated against the config schema so a typo is rejected up front.

This page covers the most common invocations. Every command supports --help for the full flag reference, and most commands accept the global flags shown by vigolium --help.

Getting Started

Native Scan

Agentic Scan

Architecture

Native Scanning Phases

Server Mode

Customization

Others

Top-Level Commands

Global flags

Scanning

Less common scan flags

Parallel & isolated scans

Running a Single Phase

Input Modes

`burpscope` — scan a bug-bounty scope file

Ingestion

Server

Database & Results

Several export formats in one run

Import

Replay

Bulk replay

Replay through a real browser

Date filtering

Fuzz

Strategies & Phases

Modules

Skills

Extensions

Scope

Agent (AI)

`agent query`: single-shot prompts

`agent triage`: confirm or retire one finding

`agent swarm`: AI-guided multi-phase scan

`agent autopilot`: autonomous agentic scan

`agent audit`: unified source audit (vigolium-audit + piolium)

`log`: replay an agentic session

Configuration

​Top-Level Commands

​Global flags

​Scanning

​Less common scan flags

​Parallel & isolated scans

​Running a Single Phase

​Input Modes

​burpscope — scan a bug-bounty scope file

​Ingestion

​Server

​Database & Results

​Several export formats in one run

​Import

​Replay

​Bulk replay

​Replay through a real browser

​Date filtering

​Fuzz

​Strategies & Phases

​Modules

​Skills

​Extensions

​Scope

​Agent (AI)

​agent query: single-shot prompts

​agent triage: confirm or retire one finding

​agent swarm: AI-guided multi-phase scan

​agent autopilot: autonomous agentic scan

​agent audit: unified source audit (vigolium-audit + piolium)

​log: replay an agentic session

​Configuration

Top-Level Commands

Global flags

Scanning

Less common scan flags

Parallel & isolated scans

Running a Single Phase

Input Modes

`burpscope` — scan a bug-bounty scope file

Ingestion

Server

Database & Results

Several export formats in one run

Import

Replay

Bulk replay

Replay through a real browser

Date filtering

Fuzz

Strategies & Phases

Modules

Skills

Extensions

Scope

Agent (AI)

`agent query`: single-shot prompts

`agent triage`: confirm or retire one finding

`agent swarm`: AI-guided multi-phase scan

`agent autopilot`: autonomous agentic scan

`agent audit`: unified source audit (vigolium-audit + piolium)

`log`: replay an agentic session

Configuration