01 / DIRECT

Set the objective.
Demand the evidence.

Describe an authorized target and outcome. VULGPT plans the smallest useful next step, grounds findings in real tool output, and stops when the objective is met.

Scope lockedSafe proof only

What should VULGPT verify?

Name the target, boundaries, and success condition. Avoid secrets in the goal.

0 / 4000

Run depth

ReconMap the exposed surface ScanTest likely weaknesses Full runRecon through report

Scope and proof controls Review before launch

Environment Impact profile

I have explicit authorizationI own or have written permission to test every target described above. Allow safe proof of concept checksPermit non-destructive validation only when existing evidence justifies it. Enable multi-agent betaUses three tightly bounded roles. It may take longer and still follows the same scope, approval, and stop rules. Include private or local addressesUse only in a controlled lab. Provider policy may still block these targets.

Scope note Optional

Descriptive audit note only. The canonical target URL subtree is the enforced boundary.

LIVE / EVIDENCE

Current session

No session in focus

Launch an authorized objective or open a previous session from History.

SESSION — Preparing workspace

Session objective

Evidence stream

Auditable output

Waiting for verified tool output.

Confirmed findings

No confirmed findings yet. Unverified hypotheses are not reported here.

02 / RECORD

Session history

Every objective, authorization note, tool observation, and confirmed finding stays attached to its session.

Recorded sessions

0 sessions

Session	Mode	Status	Findings	Started	Open

No sessions recorded

Your first authorized run will appear here with its evidence trail.

03 / CONTROL

Model providers

OpenRouter is the default model gateway. Keys go only to the local backend and are never written into browser storage.

ACTIVE PROVIDER Not configured Choose a provider below

CONNECTIONS

Configured providers

No providers configured. Add OpenRouter or another Chat Completions-compatible endpoint to begin.

ENDPOINT

Provider details

Provider name

Base URL

HTTPS is required except for explicit local development endpoints.

Model

Key environment variable

Use a variable name only. Never paste a key into this field.

Allow this provider for private targetsKeep disabled unless the endpoint and testing environment are controlled by you.

Changes apply to future model requests.

SECRET

OpenRouter API key

READINESS

Environment checks

Checking

No environment checks were returned by the local service.

Preparing the local workspace Loading providers, sessions, and environment checks…

Set the objective.
Demand the evidence.

Current session

No session in focus

Deterministic phases

What VulGpt believes now

Approval requests

Three-role execution

Evidence stream

Confirmed findings

Session history

Recorded sessions

No sessions recorded

No matching sessions

Model providers

Configured providers

Provider details

OpenRouter API key

Environment checks

Remove the runtime key?

Set the objective.Demand the evidence.

Current session

No session in focus

Session history

Recorded sessions

No sessions recorded

No matching sessions

Model providers

Configured providers

Provider details

OpenRouter API key

Environment checks

Set the objective.
Demand the evidence.