API Documentation

pip install vulnrap

from vulnrap import Client

with Client() as c:
    res = c.test_yourself(raw_text="Found a path traversal in /api/files...")
    print(f"slop={res.slop_score}/{res.slop_tier} confidence={res.confidence:.2f}")

go get github.com/REMEDiSSecurity/VulnRap.Com/sdks/go/vulnrap

import (
    "context"
    "log"

    "github.com/REMEDiSSecurity/VulnRap.Com/sdks/go/vulnrap"
)

func main() {
    c := vulnrap.NewClient()
    res, err := c.TestYourself(context.Background(), &vulnrap.TestYourselfInput{
        RawText: "Found a path traversal in /api/files...",
    })
    if err != nil { log.Fatal(err) }
    log.Printf("slop=%d/%s confidence=%.2f", res.SlopScore, res.SlopTier, res.Confidence)
}

name: VulnRap triage

on:
  pull_request:
    paths:
      - "advisories/**.md"

jobs:
  score:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # needed so the diff against the base branch works

      - name: Pick the changed advisory
        id: pick
        run: |
          file=$(git diff --name-only origin/${{ github.base_ref }}... \
                  | grep -E '^advisories/.*\.md$' | head -n1)
          echo "file=${file}" >> "$GITHUB_OUTPUT"

      - name: Score with VulnRap
        id: vulnrap
        if: steps.pick.outputs.file != ''
        uses: REMEDiSSecurity/VulnRap.Com/sdks/github-action@main
        with:
          report-file: ${{ steps.pick.outputs.file }}
          fail-threshold: 80   # block the PR if it scores 80+

      - name: Comment on the PR
        if: steps.pick.outputs.file != ''
        uses: actions/github-script@v7
        with:
          script: |
            const score   = `${{ steps.vulnrap.outputs.slop-score }}`;
            const tier    = `${{ steps.vulnrap.outputs.slop-tier }}`;
            const verdict = `${{ steps.vulnrap.outputs.verdict }}`;
            const dupes   = `${{ steps.vulnrap.outputs.similarity-match-count }}`;
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `### VulnRap analysis\n\n- **Slop score:** ${score}/100 (${tier})\n- **Verdict:** \`${verdict}\`\n- **Similar reports:** ${dupes}`,
            });

include:
  - remote: "https://raw.githubusercontent.com/REMEDiSSecurity/VulnRap.Com/main/sdks/gitlab-component/template.yml"

stages:
  - test
  - report

vulnrap-score:
  variables:
    INPUT_REPORT_FILE: advisories/CVE-2026-0001.md
    INPUT_FAIL_THRESHOLD: "80"   # block the MR if it scores 80+

report-results:
  stage: report
  needs: [vulnrap-score]
  script:
    - echo "Slop score $VULNRAP_SLOP_SCORE ($VULNRAP_SLOP_TIER)"
    - echo "Verdict $VULNRAP_VERDICT"
    - |
      if [ "$VULNRAP_VERDICT" = "AUTO_CLOSE" ]; then
        echo "This report was flagged as AI slop"
      fi

git clone https://github.com/REMEDiSSecurity/VulnRap.Com.git
cd vulnrap

helm install vulnrap ./deploy/helm/vulnrap \
  --namespace vulnrap --create-namespace \
  --set-string secrets.data.DATABASE_URL="postgresql://vulnrap:vulnrap@my-pg:5432/vulnrap" \
  --set-string secrets.data.OPENAI_API_KEY="sk-..."

claude mcp add --transport http vulnrap https://vulnrap.com/mcp

{
  "mcpServers": {
    "vulnrap": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://vulnrap.com/mcp"]
    }
  }
}