`vulkro rules`

Print the built-in detector catalogue and discover, install, verify, and manage community rule packs. Packs are ed25519-signed YAML files that live at ~/.vulkro/rule-packs/<author>/<name>/<version>/ and whose rules/*.yaml files participate in every subsequent scan.

Sub-commands

vulkro rules catalog                    # built-in detector catalogue (table)
vulkro rules catalog --format json      # ... as machine-readable JSON
vulkro rules list                       # available packs in the registry index
vulkro rules list --refresh             # ... after forcing a network refresh
vulkro rules installed                  # packs installed on this machine
vulkro rules add acme/api-security      # fetch, verify, and install a pack
vulkro rules add acme/api-security@1.2.0  # ... pinned to a version
vulkro rules verify acme/api-security   # re-verify an installed pack's signature
vulkro rules remove acme/api-security   # remove every installed version
vulkro rules update                     # refresh the registry index
vulkro rules export docs/rules --force  # regenerate the per-rule doc pages
vulkro rules import-semgrep rules.yaml  # convert a Semgrep file to vulkro rules

`rules catalog`

Prints the built-in detector catalogue: the stable rule IDs, OWASP categories, CWE numbers, slugs, and one-line descriptions every output format renders. It is generated from the built-in detector inventory (src/security/inventory.rs), the single source of truth shared with the SARIF rules table, so the JSON is a stable contract for tooling.

Flag	Description	Default
`--format <FORMAT>`	`table` (a human summary) or `json` (a machine-readable object).	`table`

The JSON envelope carries schema_version (the contract version, currently 1), generated_by (the version string of the binary that produced the catalogue), count (the number of OWASP categories in that build), and a rules array. Both generated_by and count move with each release, so treat neither as a fixed value; run vulkro rules catalog --format json for the current numbers:

{
  "schema_version": 1,
  "generated_by": "vulkro <version>",
  "count": 22,
  "rules": [
    {
      "id": "OWASP-API1",
      "name": "BrokenObjectLevelAuthorization",
      "slug": "broken-object-level-auth",
      "long_name": "API1:2023 Broken Object Level Authorization",
      "owasp_category": "BrokenObjectLevelAuth",
      "cwe": 639,
      "description": "Endpoint exposes object IDs without verifying the caller owns the object."
    }
  ]
}

`rules list` vs `rules installed`

These two answer different questions:

rules list queries the registry INDEX and shows the packs available to download. It prefers the cached index; pass --refresh (or run rules update first) to force a network fetch.
rules installed lists the packs already installed under ~/.vulkro/rule-packs/ on THIS machine. It is fully local and needs no network.

Command	Flag	Description
`rules list`	`--refresh`	Force a network refresh of the registry index before listing.
`rules installed`	-	No flags beyond the global ones.

`rules add`

Fetch a pack from the registry, verify its signature against the trust roots, and install it.

Argument	Description	Default
`<PACK_ID[@VERSION]>`	Pack id as `<author>/<name>` (for example `acme/api-security`). Append `@<version>` to pin a specific version.	latest version

`rules verify`

Re-verify the on-disk signature of an installed pack against the trust roots. Every installed version of the named pack is checked.

Argument	Description
`<PACK_ID>`	Pack id (`<author>/<name>`). Verifies every installed version.

`rules remove`

Remove every installed version of a pack.

Argument	Description
`<PACK_ID>`	Pack id (`<author>/<name>`). All versions are removed together.

`rules update`

Refresh the registry index from the upstream URL, so a later rules list sees newly published packs.

`rules export`

Export the canonical rule documentation as Docusaurus-compatible Markdown, one file per rule, under <OUT_DIR>. The canonical destination is the scanner repository's docs/rules/ (regenerate with vulkro rules export docs/rules --force); the website repository copies those pages in at build time. The pages drive the stable per-rule URLs at vulkro.com/docs/rules/<slug>, and a CI test fails the build if the committed pages drift from the catalogue.

Argument	Description
`<OUT_DIR>`	Output directory. Must already exist unless `--force` is set. Existing files matching catalogue slugs are overwritten.

Flag	Description
`--force`	Create `OUT_DIR` (and parents) if it does not exist.

`rules import-semgrep`

Import a Semgrep rule file (YAML) and emit a vulkro-format rules YAML the scanner can pick up, so an existing Semgrep rule library can be reused without rewriting metadata. Patterns translate as best-effort regex (metavariables become .+?, ellipsis becomes .*); compound shapes (pattern-either, pattern-not, patterns:) are skipped with a per-rule warning on stderr.

Argument	Description
`<SEMGREP_YAML>`	Path to the Semgrep YAML file.

Flag	Description	Default
`--output <OUT_FILE>`	Output path for the vulkro YAML.	`vulkro-rules.yaml` next to the input

The default output name (vulkro-rules.yaml at the project root) is one that vulkro scan already auto-discovers, so no extra flag is needed at scan time.

Where packs live

Installed packs land at:

~/.vulkro/rule-packs/<author>/<name>/<version>/
+-- rules/*.yaml

Their rules/*.yaml files are picked up automatically by vulkro scan and vulkro discover.

Verification

Every pack must be signed by a key in Vulkro's built-in trust list, or by a key you have installed under ~/.vulkro/trust-keys/. Unsigned packs are refused. Use rules verify <author>/<name> to re-check an installed pack's signature at any time. (The runtime --trust-key flag lives on vulkro update, not on rules.)

Air-gap

The global --offline flag (equivalent to VULKRO_OFFLINE=1) makes rules add, rules update, and rules list --refresh refuse the network and return a network-unavailable error. Everything else stays local: catalog, installed, verify, export, import-semgrep, a cached rules list, and every already-installed pack all keep working.

Exit codes

0 success (catalogue printed, pack listed / installed / verified / removed, index refreshed, docs exported, Semgrep file imported).
2 error: bad argument, IO or parse failure, a signature / verification failure, or a network error while reaching the registry.

None of the rules sub-commands return 1.

vulkro scan - the full scan that applies installed rule packs.
vulkro discover - the discovery pass that also applies packs.
vulkro update - apply signed .vkbundle updates offline (this is where --trust-key lives).
Rule reference - the per-rule pages produced by rules export.

Command reference

Generated from vulkro help rules on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Find, install and manage community rule packs.

Discover, install, and manage community rule packs. Packs live at `~/.vulkro/rule-packs/<author>/<name>/<version>/` and their `rules/*.yaml` files participate in every subsequent scan.

Usage: vulkro rules [OPTIONS] <COMMAND>

Commands:
  catalog         Print the built-in detector catalogue (stable rule IDs, OWASP categories, CWE, one-line description) for tooling to consume. `--format json` emits a stable machine-readable object; `table` prints a human summary. Covers every built-in detector; the same catalogue used by SARIF output. Exit code 0
  list            Query the registry index and list available packs. Prefers the cached index - pass `--refresh` (or run `rules update` first) to force a network fetch
  installed       List rule packs currently installed under `~/.vulkro/rule-packs/`
  add             Fetch a pack from the registry, verify its signature, and install it. `<pack-id>` is `<author>/<name>` (e.g. `acme/api-security`); append `@<version>` to pin a specific version. Default is `latest`
  remove          Remove every installed version of a pack
  verify          Re-verify the on-disk signature of a pack against the trust roots
  update          Refresh the registry index from the upstream URL
  export          Export the canonical rule documentation as Docusaurus-compatible Markdown, one file per rule, under `<out-dir>`
  import-semgrep  Import a Semgrep rule file (YAML) and emit a vulkro-format rules YAML the scanner can pick up, so you can reuse existing Semgrep rule libraries without rewriting metadata. Patterns translate as best-effort regex (metavariables → `.+?`, ellipsis → `.*`); compound shapes (pattern-either, pattern-not, patterns:) are skipped with a stderr warning per rule
  help            Print this message or the help of the given subcommand(s)

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')

$ vulkro rules catalog --help
------------------------------------------------------------
Print the built-in detector catalogue (stable rule IDs, OWASP categories, CWE, one-line description) for tooling to consume. `--format json` emits a stable machine-readable object; `table` prints a human summary. Covers every built-in detector; the same catalogue used by SARIF output. Exit code 0

Usage: vulkro rules catalog [OPTIONS]

Options:
      --format <FORMAT>  Output format: `table` (default) or `json` [default: table] [possible values: table, json]
      --offline          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help             Print help

$ vulkro rules list --help
------------------------------------------------------------
Query the registry index and list available packs. Prefers the cached index - pass `--refresh` (or run `rules update` first) to force a network fetch

Usage: vulkro rules list [OPTIONS]

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
      --refresh  Force a network refresh of the registry index before listing
  -h, --help     Print help

$ vulkro rules installed --help
------------------------------------------------------------
List rule packs currently installed under `~/.vulkro/rule-packs/`

Usage: vulkro rules installed [OPTIONS]

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help     Print help

$ vulkro rules add --help
------------------------------------------------------------
Fetch a pack from the registry, verify its signature, and install it. `<pack-id>` is `<author>/<name>` (e.g. `acme/api-security`); append `@<version>` to pin a specific version. Default is `latest`

Usage: vulkro rules add [OPTIONS] <PACK_ID[@VERSION]>

Arguments:
  <PACK_ID[@VERSION]>  Pack id, optionally with `@<version>`

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help     Print help

$ vulkro rules remove --help
------------------------------------------------------------
Remove every installed version of a pack

Usage: vulkro rules remove [OPTIONS] <PACK_ID>

Arguments:
  <PACK_ID>  Pack id (`<author>/<name>`) - versions are removed together

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help     Print help

$ vulkro rules verify --help
------------------------------------------------------------
Re-verify the on-disk signature of a pack against the trust roots

Usage: vulkro rules verify [OPTIONS] <PACK_ID>

Arguments:
  <PACK_ID>  Pack id (`<author>/<name>`). Verifies every installed version

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help     Print help

$ vulkro rules update --help
------------------------------------------------------------
Refresh the registry index from the upstream URL

Usage: vulkro rules update [OPTIONS]

Options:
      --offline  Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
  -h, --help     Print help

$ vulkro rules export --help
------------------------------------------------------------
Export the canonical rule documentation as Docusaurus-compatible Markdown, one file per rule, under `<out-dir>`.

The pages drive `vulkro.com/docs/rules/<slug>` (Sonar-style stable per-rule URLs). Findings already carry the slug via their OWASP category; the export tool just produces the linked content.

Exit code: 0 on success, 2 on IO failure.

Usage: vulkro rules export [OPTIONS] <OUT_DIR>

Arguments:
  <OUT_DIR>
          Output directory. Must already exist unless `--force` is set. Existing files matching catalog slugs are overwritten

Options:
      --force
          Create `out_dir` (and parents) if it does not exist

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -h, --help
          Print help (see a summary with '-h')

$ vulkro rules import-semgrep --help
------------------------------------------------------------
Import a Semgrep rule file (YAML) and emit a vulkro-format rules YAML the scanner can pick up, so you can reuse existing Semgrep rule libraries without rewriting metadata. Patterns translate as best-effort regex (metavariables → `.+?`, ellipsis → `.*`); compound shapes (pattern-either, pattern-not, patterns:) are skipped with a stderr warning per rule.

After import, the output file lands at a name `vulkro scan` already auto-discovers (`vulkro-rules.yaml` at project root) so no extra flag is needed at scan time.

Exit code: 0 on success, 2 on IO / parse error.

Usage: vulkro rules import-semgrep [OPTIONS] <SEMGREP_YAML>

Arguments:
  <SEMGREP_YAML>
          Path to the Semgrep YAML file

Options:
      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --output <OUT_FILE>
          Output path for the vulkro YAML. Defaults to `vulkro-rules.yaml` next to the input file

  -h, --help
          Print help (see a summary with '-h')

Sub-commands​

rules catalog​

rules list vs rules installed​

rules add​

rules verify​

rules remove​

rules update​

rules export​

rules import-semgrep​

Where packs live​

Verification​

Air-gap​

Exit codes​

Related​

Command reference​