Metadata-Version: 2.4
Name: vulnlogic
Version: 2.0.0
Summary: Free API penetration testing from your terminal — zero config, zero cost
Author-email: VulnLogic <hello@vulnlogic.my>
License: MIT
Project-URL: Homepage, https://www.vulnlogic.my
Project-URL: Repository, https://github.com/loremipsum90/vulnlogic-cli
Keywords: security,pentest,api,vulnerability,scanning,idor,owasp
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: click>=8.1.0
Requires-Dist: rich>=13.0.0
Requires-Dist: requests>=2.31.0
Requires-Dist: aiohttp>=3.9.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: pyyaml>=6.0

# VulnLogic CLI

Autonomous AI-powered API penetration testing. 63 attack modules. Zero false positives.

## Install

```bash
pip install vulnlogic
```

## Quick Start

```bash
# Set your Anthropic API key (one time)
vulnlogic config set anthropic-key sk-ant-...

# Run a scan
vulnlogic scan --target myapi --base-url https://api.acme.com --spec openapi.json --token eyJ...
```

## Usage

```bash
# Basic scan
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json --token eyJ...

# IDOR testing — provide attacker + victim tokens
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --token eyJ... --victim-token eyJ...

# Run only specific attack groups
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --groups authorization,injection,business_logic

# JSON output
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json --output json

# CI/CD — SARIF output + exit code 1 on high+ findings
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --output sarif --output-file results.sarif --fail-on high

# Against a hosted VulnLogic engine
vulnlogic scan -t myapi -u https://api.acme.com -s openapi.json \
  --engine-url https://engine.vulnlogic.io

# List all 63 modules
vulnlogic modules
```

## GitHub Actions Example

```yaml
- name: API Security Scan
  run: |
    pip install vulnlogic
    vulnlogic scan \
      --target ${{ github.repository }} \
      --base-url ${{ secrets.API_URL }} \
      --spec openapi.json \
      --token ${{ secrets.API_TOKEN }} \
      --output sarif \
      --output-file vulnlogic.sarif \
      --fail-on high
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: vulnlogic.sarif
```

## Attack Groups

| Group | Modules |
|-------|---------|
| authorization | IDOR, Horizontal Privesc, Mass Assignment, BFLA |
| business_logic | Race Condition, Workflow Bypass |
| authentication | JWT None Alg, JWT Confusion, JWT Expired |
| api | Parameter Tampering, Rate Limit Bypass |
| injection | SSRF, Path Traversal, SQLi, NoSQLi, XXE |
| file_upload | Unrestricted Upload, Path Traversal via Filename |
| infrastructure | CORS, Security Headers, GraphQL, HTTP Smuggling |
| cryptography | Weak Algorithms, Hardcoded Secrets |
| websocket | WebSocket Hijacking |
| multi_tenant | Tenant Isolation Bypass |
