llms.txt
+63 −20
− # VulKill− > VulKill provides authorized source-code, dependency and web/API security scanning through MCP and API. Public product pages and policies below are authoritative.− ## Product− - [Product and security scope](https://vulkill.com/en/)− - [Plans and pricing](https://vulkill.com/en/pricing)− - [Account workspace](https://app.vulkill.com/en/about)− - [MCP setup: ChatGPT, Claude and Gemini](https://vulkill.com/en/mcp-guide)− - [Türkçe MCP kurulum rehberi](https://vulkill.com/mcp-guide)− - [Public project](https://github.com/dytredline/VulKill)− ## Connecting an AI client− MCP uses the authenticated Streamable HTTP endpoint at https://app.vulkill.com/api/mcp. Start the connection in your MCP client and authorize your own VulKill account through OAuth. API-key authentication is an alternative for compatible clients. Signing in to the website alone does not connect an AI application.− The setup guide covers ChatGPT, Claude, Gemini CLI and Antigravity. Remote scans require an authorized target and sufficient credits. Web targets require ownership verification. Code scans need the selected file contents, not only a local path. Reports and account records are private. Reading the credit balance does not start a scan.− The GitHub project and the hosted commercial service have distinct licenses. Consult the relevant license and service terms before use.− ## Policies− - [Commercial terms](https://vulkill.com/en/term)− - [Privacy and code retention](https://vulkill.com/en/privacy)− - [Refunds and cancellation](https://vulkill.com/en/refund-policy)− ## Language discovery− The website and MCP guide have 21 static language versions with canonical and reciprocal hreflang links. The sitemap lists public canonical pages: https://vulkill.com/sitemap.xml− Contact: info@vulkill.com+ # VulKill Security (vulkill.com & app.vulkill.com)+ > AI-native autonomous security testing, deep source-code & data-flow verification, mobile & desktop binary security, cloud/IaC auditing, and live web/API pentesting — connected directly to ChatGPT, Claude, Cursor, VS Code, Gemini CLI, and CI/CD via Model Context Protocol (MCP) and REST API.+ VulKill Security combines a 4-stage autonomous AI pentest loop (`Map → Attack & Prove → Patch → Retest`), Z3 symbolic path verification, cross-language Code Property Graph (CPG / AST) taint analysis, Code-First DSPM (KVKK/GDPR privacy flow auditing), AI/MCP agent security (`AI-BOM`), Web3 & wallet blind-signing verification, supply-chain SBOM/license/malware analysis, and verified live DAST into a single workspace with a strict zero persistent source-code retention guarantee.+ ## Canonical URLs & Entry Points+ - Product & Capabilities Overview: https://vulkill.com/+ - English Homepage: https://vulkill.com/en/+ - SaaS Workspace & Dashboard: https://app.vulkill.com/+ - Public Workspace Overview: https://app.vulkill.com/en/about+ - MCP Setup Guide (ChatGPT, Claude, Cursor, VS Code, Gemini CLI): https://vulkill.com/mcp-guide+ - Pricing & Credit Plans: https://vulkill.com/pricing+ - Privacy Policy (GDPR, KVKK & Zero Source-Code Retention): https://vulkill.com/privacy+ - Terms of Service & Commercial EULA: https://vulkill.com/terms+ - Refund & Cancellation Policy (Paddle Merchant of Record): https://vulkill.com/refund-policy+ - Remote MCP Server Endpoint (Streamable HTTP / JSON-RPC 2.0): https://app.vulkill.com/api/mcp+ - OpenAPI 3.1 Specification: https://app.vulkill.com/openapi.json+ - OAuth 2.0 Protected Resource Metadata: https://app.vulkill.com/.well-known/oauth-protected-resource+ - OAuth 2.0 Authorization Server Metadata: https://app.vulkill.com/.well-known/oauth-authorization-server+ - Sample Report 1 (AI, LLM & MCP Capabilities Pentest PDF): https://vulkill.com/samples/vulkill-sample-ai-mcp-pentest-report.pdf+ - Sample Report 2 (Web, API & External Network Pentest PDF): https://vulkill.com/samples/vulkill-sample-web-network-pentest-report.pdf+ - Sample Report 3 (Mobile Android/iOS & Desktop Electron/Tauri Pentest PDF): https://vulkill.com/samples/vulkill-sample-mobile-desktop-pentest-report.pdf+ ## Core Architecture: 4-Stage Autonomous AI Pentest Loop+ 1. **Stage 1 — Map (Mimari ve Saldırı Yüzeyi Haritalama)**: Automatically discovers application routes, API schemas (REST, GraphQL, WebSocket, gRPC, webhooks), authentication/session flows, trust boundaries, cloud/IaC resources, and AI/MCP tool surfaces.+ 2. **Stage 2 — Attack & Prove (3 Katmanlı Kanıt ve Sembolik Doğrulama)**: Validates candidate vulnerabilities using 3-layer evidence (`Layer 1: Reachability & Data Flow`, `Layer 2: Exploit Proof / Z3 Symbolic Feasibility`, `Layer 3: Real-World Business Impact`) to eliminate false positives and dead-code noise.+ 3. **Stage 3 — Patch (Kopyala-Yapıştır Üretim Yaması)**: Generates context-aware, copy-paste-ready remediation diffs tailored to the exact file, line, framework, and language.+ 4. **Stage 4 — Retest (RED → GREEN Regresyon Doğrulaması)**: Re-runs the exact verification vector after remediation and records a cryptographic/auditable scope ledger proving transition from vulnerable (`RED`) to remediated (`GREEN`).+ ## Specialized Security Capabilities (260+ Controls Across 12 Domains)+ - **Z3 Symbolic Execution & Cross-Language CPG/AST Taint Analysis**: Tracks untrusted input to sensitive sinks (SQLi, Command Injection, SSTI, SSRF, Path Traversal, Deserialization, XXE, Prototype Pollution, ReDoS) across Python, JavaScript/TypeScript, Go, Rust, Java/Kotlin, C/C++, C#, PHP, Ruby, Swift, and Solidity — including FFI, JNI, Node native addons, WebAssembly, and IPC bridges.+ - **Code-First DSPM (KVKK & GDPR Privacy Flow Audit)**: Identifies PII, financial, health, and credential data flows directly from source code and schemas without connecting to live production databases. Detects unmasked logging, analytics/SDK leakage, and unauthorized PII transmission to external LLM APIs.+ - **Vibe Coding & PR Diff Security Audit**: Fast incremental security review for AI-generated code (ChatGPT, Claude Code, Cursor, Copilot, Windsurf) and pull request diffs — catching broken object-level authorization (IDOR/BOLA), missing tenant isolation, race conditions, insecure defaults, and hallucinated packages (`slopsquatting`).+ - **AI Agent, LLM, RAG & MCP Server Pentesting + Shadow AI Inventory (AI-BOM)**: Automatically inventories all AI SDKs, models, vector databases, and MCP servers in the codebase (`AI-BOM`). Audits direct/indirect prompt injection, RAG poisoning, MCP tool over-privilege (`Excessive Agency`), missing human-in-the-loop approval, and insecure LLM output handling.+ - **Web3, Smart Contract & Wallet Blind Signing Security**: Audits Solidity/EVM and Solana contracts (reentrancy, access control, oracle manipulation, delegatecall/proxy risks) alongside EIP-712 structured signing payloads, wallet blind-signing deception, and external KMS/HSM signer isolation.+ - **Supply Chain, Reachable SCA, SBOM (CycloneDX / SPDX), License Risk & Malware Detection**: Combines reachability analysis (whether a vulnerable dependency function is actually called) with open-source license compliance (`GPL`, `AGPL`, `SSPL` copyleft detection), End-of-Life (`EOL`) runtime detection, and malicious package / install-hook (`preinstall`/`postinstall`) inspection.+ - **Mobile (Android APK/AAB, iOS IPA, Flutter, React Native) & Desktop (Electron, Tauri) Hardening**: Covers MASVS/MASTG mobile controls (manifest, deep links, WebView, certificate pinning, Keystore/Keychain, Privacy Manifest) and desktop/binary hardening (`nodeIntegration`, `contextIsolation`, custom protocol handlers, ELF/PE/Mach-O PIE, RELRO, Stack Canary, NX).+ - **Cloud IAM, Kubernetes, Container & Infrastructure-as-Code (IaC)**: Audits Dockerfile, Kubernetes manifests, Helm, Terraform, CloudFormation, cloud storage permissions, metadata SSRF (`169.254.169.254`), and DNS/TLS/email security (`SPF`, `DKIM`, `DMARC`, subdomain takeover).+ ## 5 Scan Modes (`mode`)+ - `auto`: Automatically selects applicable checks based on supplied `sourceFiles` and/or verified HTTPS `targetUrl` (up to 5,000 files per shard with automatic parallel sharding).+ - `source`: Fast static source, secret, dependency, and configuration audit (`SAST + Secrets + SCA`).+ - `semantic`: Deep cross-file AST/CPG taint analysis, Z3 symbolic path verification, business logic, and cross-language bridge auditing.+ - `infrastructure`: Container, Kubernetes, Terraform/IaC, CI/CD pipeline, SBOM, license, and supply-chain integrity audit.+ - `web`: Low-impact live DAST and API security verification against ownership-verified HTTPS targets (`targetUrl`).
Showing the first 40 of each.