vulnscan·ai
v0.1.11 · Apache-2.0 · RHEL 9 / 10

Find what's vulnerable.
Fix it without breaking it.

A FIPS-aware vulnerability scanner for RHEL-based hosts, with AI-assisted, approval-gated, transactional remediation — every fix is snapshotted, validated, and rolled back automatically on failure.

Install on RHEL Browse the repo →

Install

Signed dnf repository — one drop-in covers EL9 and EL10 via $releasever.

# Trust the signing key and add the repository
sudo rpm --import https://repo.techhack.nl/RPM-GPG-KEY-techhack
sudo tee /etc/yum.repos.d/techhack.repo <<'EOF'
[techhack]
name=techhack tools (EL$releasever)
baseurl=https://repo.techhack.nl/el$releasever
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://repo.techhack.nl/RPM-GPG-KEY-techhack
EOF

# Install and run your first scan
sudo dnf install vulnscan-ai
vulnscan-ai scan

Packages are GPG-signed and repository metadata is signed (repo_gpgcheck=1), signed by techhack release signing <security@techhack.nl>. Per-version install pages live on the repository.

Why vulnscan-ai

Built for production RHEL fleets where a careless fix is worse than the vulnerability.

🔄

Transactional remediation

Config and service fixes are applied as a transaction: backup → validate → reload → health-check, with automatic rollback if anything fails.

✋

Approval-gated AI

The model proposes a structured plan; nothing runs until you approve it. A deny-list screens every command before execution.

🎯

Low false-positive rate

Drops Red Hat "Not affected" CVEs and downgrades vulnerabilities in daemons that are installed but not running — real signal, less noise.

🧰

Many scanners, one view

dnf/RHSA, OpenSCAP OVAL, sshd hardening, systemd sandboxing and open ports — de-duplicated into a single prioritized report.

🔐

FIPS-aware

Understands FIPS mode and the RHEL crypto policy, so findings and fixes respect a hardened, compliant baseline.

🤖

Your choice of model

Claude by default; OpenAI, Gemini, Kimi, DeepSeek and Mistral supported, plus fully local models via Ollama for air-gapped hosts.

How it works

From detection to a verified fix, with you in the loop.

  1. ScanCollect findings from every available scanner on the host.
  2. EnrichAdd CVE detail, vendor fix state and runtime exposure from the security feeds.
  3. PlanThe AI proposes a structured, screened remediation for each finding.
  4. Approve & applyYou confirm; the fix applies transactionally and rolls back on any failure.

Prefer not to apply on the host? Export any fix as a bash script or an Ansible playbook with vulnscan-ai fix --export-script / --export-ansible.