Skip to main content

vulkro explain

Explain a finding with framework-aware remediation guidance. Pass a finding ID (from vulkro scan --format json) or an OWASP API category code and Vulkro prints what the issue is, why it matters, and how to fix it for your stack.

Usage​

vulkro explain <ID_OR_CATEGORY> [PATH]
ArgumentDescriptionDefault
<ID_OR_CATEGORY>A finding ID (for example JAVA-SQLI-001) or an OWASP category (for example API2).required
PATHPath to the project root..

Examples​

# Explain a rule by ID.
vulkro explain JAVA-SQLI-001

# Explain an OWASP API category.
vulkro explain API2

# Find IDs to explain from a JSON scan.
vulkro scan . --format json | jq -r '.findings[].rule_id' | sort -u

Passing the project PATH lets explain tailor the remediation to the framework it detects there.

Command reference​

Generated from vulkro help explain on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Explain one finding: what it means, why it matters, and how to fix it in your framework.

Explain a finding with framework-aware remediation guidance.

Exit code: 0 explanation printed (or `--risk-model` doc), 2 on a bad argument (no ID and no `--risk-model`) or a scan / IO error. It prints guidance, it does not fail on findings, so it never returns 1. `--ai` never changes the exit code.

Usage: vulkro explain [OPTIONS] [ID_OR_CATEGORY] [PATH]

Arguments:
  [ID_OR_CATEGORY]
          Finding ID (from `vulkro scan --format json`) or OWASP category (e.g. API2). Optional when `--risk-model` is passed

  [PATH]
          Path to the project root
          
          [default: .]

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --risk-model
          Print the deterministic risk-score model (the exact formula `scan --top` and `vulkro summary` use to rank findings) and exit. No project scan runs. Ignores the ID argument

      --ai
          [advisory] After the deterministic explanation, print a plain-language local-model narrative (what this is, why it matters in THIS code, how to fix it here) for the matched finding. ADDITIVE and ADVISORY: the deterministic explanation above is unchanged and is the source of truth; the AI text is labelled advisory / non-deterministic / excluded-from-benchmark and NEVER changes the exit code. Ignored with `--risk-model`. A loopback model is allowed under VULKRO_OFFLINE; a cloud url is refused offline. Configure with `vulkro ai`

  -h, --help
          Print help (see a summary with '-h')
Last updated on