CVEngine is a free attack-surface scanner that AI agents can run
CVEngine is a new free scanner that finds exposed services on your domains and matches them to known attacks. An AI agent can run the whole loop through an MCP server. The repository picked up 203 stars in two days.
Image: GitHub
Why it mattersA small team that could not pay for an attack-surface tool now has a free one. An AI agent can run it on command.
A security team at a smaller company has one real choice. The commercial attack-surface scanners cost real money per seat.
CVEngine is a new open-source project that aims at that gap. The user hevnsnt published it on GitHub on 24 October 2026. It is a fork of reNgine 2.x by Yogesh Ojha. The licence is GPL-3.0. The repository shows 203 stars and 32 forks on 26 October 2026.
What the scanner does
The readme describes one pipeline for every target the user adds. A domain, an IP, a CIDR range or a URL goes in. bbot discovers subdomains in passive, standard or deep mode. naabu sweeps all 65,535 ports on each host. nmap fingerprints the services on the open ports. nuclei runs CVE and technology checks against them.
The project also looks for databases that answer without a login. Redis, Memcached, PostgreSQL, Elasticsearch and CouchDB are each probed. It also runs email checks for SPF, DKIM, DMARC and other common domain records.
Every CVE match is rated fire, smoke or ice. The ratings come from the CISA Known Exploited Vulnerabilities list, ENISA EUVD, Metasploit, Exploit-DB, EPSS and CVSS. The AI, when connected, triages each finding. The labels are confirmed, likely, needs validation, likely false positive, or not applicable. Each check records the exact command it ran.
How an AI agent uses it
The project includes a Model Context Protocol server at /mcp/. It also carries an OpenAPI specification. The readme says agents work under the same role-based permissions a human user does. A read-only token can scan and read findings but cannot change settings.
The user brings their own keys for Anthropic, OpenAI or OpenRouter. They can also run a model on their own hardware with Ollama or vLLM. Without a model the scanner still runs. The AI then adds triage, custom nuclei template drafts, and targeted re-scans.
The maintainer makes one hard rule plain in the readme. When no scanner template exists for a CVE, the AI drafts one. The draft never runs on the user's hosts until a person approves it. An auto-fire mode tests new CVEs as soon as the feed delivers them, and comes off by default.
What the readme does not claim
The readme does not compare CVEngine to a named commercial scanner. It shows no throughput, latency or false-positive numbers. The 203-star figure is the only outside signal of use.
The project is a one-maintainer fork and two days old. Some integrations and alert channels sit behind an admin switch. A security team should run its own measurements on a known-good target before trusting a verdict. The minimum system requirement is a Linux box with 4 GB of RAM, 20 GB of disk and Docker.
Source
- hevnsnt/CVEngine, hevnsnt on GitHub.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
