vulncheck-cli

VulnCheck CLI

Binary is vulncheck — not vulncheck-cli, not vci. No || fallbacks, no echo error strings. Run commands directly. VulnCheck is a standalone CLI — it does not require a project directory.

If not authenticated, run vulncheck auth login before proceeding.

Auth

vulncheck auth status    # check current auth state
vulncheck auth login     # log in (requires TTY)
vulncheck auth logout    # log out

Indices

VulnCheck has 490+ named indices — vendor advisories, CVE feeds, exploit data, KEV lists, and more.

List all available indices (use only when discovering index names — if you already know the index name, query it directly):

vulncheck indices list --json              # plain JSON array of {name, description, href}
vulncheck indices list --json | jq '.[].name'                  # all names
vulncheck indices list --json | jq '.[] | select(.name | contains("nvd"))'  # filter
vulncheck indices browse                   # interactive (requires TTY)

Query an index (returns a plain JSON array, no --json flag needed):

vulncheck index list <index-name>
vulncheck index list <index-name> --cve CVE-2021-44228
vulncheck index list <index-name> --limit 10 --sort date_added
vulncheck index list <index-name> --pubStartDate 2024-01-01 --pubEndDate 2024-06-30
vulncheck index list <index-name> --cursor <value>    # next page
vulncheck index list <index-name> --page 2            # page-based pagination
vulncheck index browse <index-name>                   # interactive (requires TTY)

Pipe to jq for filtering, e.g. | jq '.[0]' for the first record. For 30+ additional flags (CIDR, ASN, threat actor, ransomware, MITRE ID, etc.) run vulncheck index list --help.

Common indices:

Index	Contents
vulncheck-nvd2	NVD CVE data enriched by VulnCheck
vulncheck-kev	VulnCheck Known Exploited Vulnerabilities
cisa-kev	CISA KEV catalog
initial-access	Initial Access Intelligence (exploits, PoCs)
ipintel-3d / ipintel-10d / ipintel-30d / ipintel-90d	IP Intelligence (by timeframe)

Download a backup:

vulncheck backup download requires a TTY and will fail in this environment. Use the signed URL instead:

# Get the URL (default — always extract .url so the user can copy-paste it)
vulncheck backup url <index-name> --json | jq -r '.url'

# Download directly
vulncheck backup url <index-name> --json | jq -r '.url' | xargs curl -OL

Always run the jq -r '.url' form — never dump the raw JSON. The user needs a plain URL they can use.

Utility

vulncheck version    # show current version, build date, and changelog URL
vulncheck upgrade    # upgrade the CLI to the latest release

Reference Files

Task	Reference
PURL and CPE package lookups	references/purl-cpe.md
Scan a project directory for vulnerable dependencies	references/scanning.md
Air-gapped / offline scanning and lookups	references/offline.md
IP intelligence, C2 infrastructure, protective DNS	references/ip-intelligence.md
Detection rules, Snort/Suricata, Initial Access Intelligence	references/initial-access.md
API token management	references/token.md