VulnScout Documentation

Contents:

• VulnScout
  • Introduction
    • VulnScout Features
  • Architecture
    • Supported Input Files
    • Supported Output Files
    • Vulnerability Data Sources
    • Custom CVSS Scoring
  • Licence
• Getting Started
  • Requirements
  • Installation
  • First Run
  • Starting the Web Interface
  • Stopping VulnScout
• VulnScout CLI
  • Container Lifecycle
  • Updating VulnScout
  • Interactive Mode (Web UI)
    • Web Interface Settings
    • Removing Outdated Data
  • Projects and Variants
  • Input Sources
    • Refresh Vulnerability Data
    • SPDX SBOM
    • CycloneDX SBOM
    • Yocto CVE Check Output
    • Yocto VEX Output
    • OpenVEX
    • Grype
    • Combining Inputs
  • Performing a Grype Scan
  • Performing an sbom-cve-check Scan
  • Non-Interactive Mode (CI / Automation)
  • Report Generation
  • Exporting SBOM Files
  • Exporting and Importing Custom Assessments
    • VulnScout JSON
    • OpenVEX
  • Configuration
    • Configuration Commands
    • Environment Variables
  • HTTP Proxy Configuration
• Using Container Entrypoint
  • Container Lifecycle
  • Command Reference
    • Settings
    • Input Commands
    • Scan & Output Commands
    • Data Retrieval Commands
    • Configuration Commands
    • Other Commands
  • Exit Codes
  • Execution Order
  • Internal Paths
  • Examples
• Interactive Mode
  • Getting Started with vulnerability analysis
    • Starting a New Project
    • Threat Model
    • Assessment Status in VulnScout
    • Goal of the Interactive Mode
  • SBOM Table
    • Search
    • Column Visibility
    • Filters
    • Match Condition
    • Actions
  • Vulnerability Table
    • Search
    • Column Visibility
    • Filters
    • Row Selection and Bulk Editing
    • Refreshing Vulnerability Data
    • ENISA EUVD Enrichment
    • Sorting
    • Opening a Vulnerability
  • Vulnerability Details
    • Header and Metadata
    • CVSS Vectors
    • Descriptions and Links
    • Time Estimation
    • Assessments
    • Navigation
  • Scan History
    • Scanners
    • Running Scans
    • Source Visibility Toggles
    • Importing and Exporting Scan Data
    • Timeline Layout
    • Scan Descriptions
    • Diff Details Modal
    • Scan Result Modal
    • Scan Export
  • Review
    • Assessment Table
    • Search and Filters
    • Import and Export
• AI Assessments
  • How it works
  • Prerequisites
  • Step 1 — Configure the vulnscout-mcp server
    • GitHub Copilot CLI
    • VS Code (GitHub Copilot extension)
    • Available MCP tools
  • Step 2 — Use the cve-assessment skill
  • Step 3 — Review AI assessments in the web interface
  • Troubleshooting
• Writing Report Templates
  • Templating System
    • Template Locations
    • Adding a Custom Template
    • Automatic Generation
    • Global Variables Available in Templates
    • Environment Variables Available in Templates
    • Vulnerability Object
    • Package Object
    • Assessment Object
    • Project Object
    • Variant Object
    • Scan Object
    • SBOM Document Object
  • Filters and Helpers
    • Conversion
    • Status Filtering
    • Score Filtering
    • Date Filtering
    • Sorting
    • Relational Filtering
  • Common Examples and Tips
  • Traversing the data models
  • Using Images and Logos in Reports
    • embed_image(name, width=None, alt="")
    • find_asset(name)
    • Asset Search Order
    • Adding Assets
    • Native image:: Macros (secondary mechanism)
• Writing Match Conditions
  • Synopsis
  • Description
  • Exit Status
  • Examples
  • Global Syntax and Language Definition
  • Tokens
  • Common Examples and Tips
• REST API
  • Version & Status
    • Get Server Version
    • Get Initial Scan Status
  • Config
    • Get Current Config
  • Projects
    • List Projects
    • Create Project
    • Rename Project
    • Delete Project
  • Variants
    • List All Variants
    • List Variants for a Project
    • Create Variant
    • Rename Variant
    • Delete Variant
  • Context
    • Get Merged Context
    • Get or Update Project Context
    • Update Variant Context
    • Import or Export Context
    • Manage Supplemental Context Files
  • Packages
    • List Packages
  • Vulnerabilities
    • List Vulnerabilities
    • Get Single Vulnerability
    • Update Vulnerability
    • Batch Update Vulnerabilities
    • Evaluate a Match Condition
    • Search Vulnerability Descriptions
  • Assessments
    • List Assessments
    • Get Single Assessment
    • List Assessments for a Vulnerability
    • List Assessments for Review
    • List Variants for a Vulnerability
    • Reconcile an Assessment
    • Approve an AI Assessment
    • Reject an AI Assessment
    • Create Assessment
    • Batch Create Assessments
    • Update Assessment
    • Delete Assessment
    • Review Assessments (User-Created)
    • Custom Data Import / Export
  • Documents
    • List Available Documents
    • Generate / Download Document
    • Export Multiple Documents
  • Scans
    • List Scans
    • List Scans for a Project
    • List Scans for a Variant
    • Update Scan Description
    • Delete Scan
    • Get Scan Diff
    • Get Scan Global Result
    • Export Scan Diff
    • Export Scan Global Result
    • Export All Scans
  • NVD Refresh
    • Refresh a Single CVE
    • Bulk NVD Refresh
    • Cancel Bulk NVD Refresh
  • Scan Triggers
    • Trigger Grype Scan
    • Check Grype Scan Status
    • Trigger NVD Scan
    • Check NVD Scan Status
    • Trigger OSV Scan
    • Check OSV Scan Status
    • Trigger sbom-cve-check Scan
    • Check sbom-cve-check Scan Status
  • SBOM Upload
    • Upload SBOM Files
    • Check Upload Status
  • Progress
    • NVD Progress
    • EPSS Progress
• Developer’s Guide
  • Developing VulnScout
    • Requirements
    • Project Structure
    • Modify the Backend
    • Modify the Frontend
  • Testing the Project
    • Quick Setup with CQFD
    • Running Tests Locally (without CQFD)
    • Setting a Custom Version
    • Testing the Docker Image
  • Code Quality and Linting
    • Python Backend (Flask)
    • Frontend (React + TypeScript)
    • Bash Scripts (vulnscout and entrypoint.sh)
    • Pre-commit Hook
  • Building the Documentation
    • Local Build
    • Building with CQFD
  • Release Process
    • Version Numbering Strategy
• Yocto Integration
  • meta-vulnscout
    • Features
    • Getting Started