NoVul

NoVul: Menu bar app that checks installed software and code packages for known security vulnerabilities and exposed secrets.

NoVul is a menu bar application for macOS that scans projects, Homebrew packages, global packages, runtimes, AI tools, and configuration files for vulnerabilities and exposed secrets. It checks lockfiles from npm, pnpm, Yarn, Bun, uv, Poetry, Pipenv, PDM, requirements.txt, Composer, Go, Cargo, Bundler, Dart/Flutter, and Mix. The app ranks security problems by malicious status, CISA KEV exploitation, severity, and EPSS scores, while keeping all code, files, and keys on the local machine. Vulnerability data is sourced from OSV.dev, GitHub advisories, CISA, FIRST, and endoflife.date. Users can view fix plans with specific terminal commands or integrate NoVul with coding agents like Claude Code, Codex, and OpenCode through its CLI and MCP server.

NoVul at a glance

Best for: Software engineer
Runs on: macOS, CLI
Pricing: Free
Released: October 2026
Category: AI coding tool
Website: github.com/misbahsy/novul

Key features

Scans project lockfiles for known package vulnerabilities
Checks Homebrew formulae and global packages
Detects API keys and tokens in plain-text files using gitleaks
Ranks problems by exploitation status, severity, and EPSS score
Provides a command-line interface and MCP server for coding agents
Performs automated background scans every 30 minutes
Stores all scan results locally in a SQLite database

Use it for

Scan local project dependencies for security vulnerabilities
Detect exposed API keys and secrets in configuration files
Send security issues to coding agents for automated repair
Monitor global packages, runtimes, and AI tools for updates

Alternatives to NoVul

CodexBar — See Codex, Claude, Cursor and 86 other limits in the menu bar
Vulert — Monitor software vulnerabilities through manifest uploads without needing installation.
Postquel — Uses your existing local Claude Code, Codex, or Cursor AI account.
Quotio — It unifies multiple AI provider accounts and tracks quotas in one dashboard.
Ballast — Finds hidden developer clutter across more than 60 tools and safely reclaims disk space.
Limitly — Shows AI usage limits directly in the Mac menu bar with zero configuration.
SkillTotal — Scans code locally without accounts, telemetry, API tokens or executing the files.
Frizky Kramer — Integrates with existing Claude Code, Codex, or Cursor installations.
Baa — Monitors memory pressure and clears idle background processes in one click.
Farol — Run Claude Code and Codex agents in parallel with isolated git worktrees.
cmux — It features vertical tabs, notification rings, and split panes for AI coding.
shim-cli — Masks sensitive data and tracks costs for coding agents locally.

All NoVul alternatives