AutoCVE
A multi-agent security platform that automates finding, verifying and reporting CVEs in a project's source code, from importing a repository through to a ready-to-submit CVE report.
AutoCVE automates the workflow of discovering CVE-worthy vulnerabilities in source code. An orchestrator coordinates Recon, Scan, Triage, Finding and Verification agents to gather information, run scanning tools, filter out false positives, dig into promising leads and dynamically verify a candidate vulnerability, and the user can choose from three audit modes that trade off speed, depth and coverage.
A dedicated Finding agent analyzes source code directly using a ReAct loop, specialized tool calls and a structured stop mechanism to produce vulnerabilities that meet CVE-submission criteria, and the tool keeps an activity log, an agent tree and tool-call history so a person can review and question any audit afterward. Discovered vulnerabilities are deduplicated and stored in a vulnerability-management module, and per-agent Skills can be configured to extend what each agent can do. It deploys with a single Docker Compose command.