AutoCVE

AutoCVE is an agent-driven platform that automates source code auditing, vulnerability verification, and report generation for CVE discovery.

AutoCVE is an automated platform designed for CVE discovery and vulnerability auditing. It utilizes a multi-agent architecture where an Orchestrator coordinates specialized agents like Recon, Scan, Triage, Finding, and Verification to perform information gathering, tool scanning, and deep vulnerability analysis. Users can select from three audit modes—enhanced scanning, intelligent auditing, or comprehensive auditing—to balance scanning efficiency with depth. The system supports interactive auditing, allowing users to query agents about evidence and reproduction steps, and maintains a structured vulnerability database. AutoCVE also features a skill-based configuration system for extending agent capabilities and provides visualization of audit logs and agent workflows.

AutoCVE at a glance

Best for: Software engineer
Runs on: Linux, macOS, Windows
Pricing: Free
Released: June 2026
Category: AI coding tool
Website: github.com/larlarua/AutoCVE

Key features

Multi-agent collaborative audit architecture
Automated CVE report generation
Interactive auditing with full process tracking
Structured vulnerability management database
Configurable agent skills for capability expansion
Three distinct audit modes for flexible analysis
ReAct Loop-based vulnerability verification

Use it for

Automated vulnerability discovery in open source projects
Filtering false positives from automated scans
Generating formal reports for CVE submission
Performing deep source code security audits

Alternatives to AutoCVE

CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
Security Audit Skill — Automated multi-stage security auditing with independent verification.
CVEngine — It runs asset discovery, vulnerability scans, and AI triage in one continuous loop.
ECC — It provides a shared operating layer and security scanning across multiple coding agents.
DeepAudit — Multi-agent architecture and sandbox PoC verification reduce false positives.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
Autoloom — It embeds engineering judgment, change necessity checks, and evidence-backed delivery into automated coding.
Polylane — It autonomously investigates production errors and submits ready-to-merge PR fixes.
DeepSource — Automated code reviews that combine static analysis with AI agents.
Autonomous Pentest Agent — Dual-graph architecture for asset synchronization and multi-step attack planning.
AI-DLC Workflows — Connects requirements, decisions, implementation, tests, and operations through one audited lifecycle.
Deepsec — Runs security reviews on all existing code using scaled VM fanout.

All AutoCVE alternatives