> For the complete documentation index, see [llms.txt](https://blog.p1k4chu.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.p1k4chu.com/security-research/ai-security-research/automating-cyber-vulnerability-research-through-semi-autonomous-agentic-workflows.md).
# Automating Cyber Vulnerability Research Through Semi Autonomous Agentic Workflows
This blog introduces a new agentic skill toolkit called "vuln-research-agent" that is LLM and harness agonistic, intended to help SecOps personnel with vulnerability research.
## What is this?
I've been in a situation countless times when I was asked to "Triage a specific vulnerability". More often than not, the process starts with a simple, urgent question: **"What does this CVE mean for us?"**
If you work in SecOps or detection engineering, you know the drill. Your first 30 minutes will typically look like this -
* You search NVD and other places to get a glimpse of the issue and try to grapple through complicated descriptions
* You compare conflicting CVSS scores between NVD and vendor advisories.
* You search GitHub for a proof-of-concept, scroll through noisy threads on X and Reddit, and check whether anyone is seeing active exploitation on GreyNoise or VirusTotal.
By the end of it, you have a fragmented collection of notes, links, and unverified claims that are nearly impossible to reproduce or standardize for your team.
`vuln-research-agent` was built to solve this exact workflow bottleneck. It packages vulnerability investigation into a single reusable command, an Agent Skill, and a Model Context Protocol (MCP) server. Give it a CVE ID or a product and version, and it gathers evidence, validates sources, and delivers a structured 12-field research report.
### Why is agentic automation needed for researching vulnerabilities?
The following is a graph of CVEs being issued in the recent years. There's a clear uptick in the number of vulnerabilities reported after AI is commercially available for security researchers around the world. There's a lot of AI slop, that's for sure. All these CVEs might not be really critical vulnerabilities but very trivial security issues. But there's no denying that AI models have consistently become better at identifying security issues.
With frontier models becoming good at identifying security issues, the trend is definetly not going down. The burning question is, as an organization, how does this affect you? On one hand, you have swarms of agent attacking you, creating 0days and on the other, you have a security researcher who's using claude with a prompt - "*Can you please tell me about CVE-XXXX XXXXX*".
The problem is not with the tool. AI is as good as the tools and context it has. Claude will immediately search the Internet and will summarize the content that it sees. It doesn't do research enough for a SecOps person to understand the full picture
### Solution - A Semi-Autonomous Agentic Skill with Tools
A raw CVE record only tells part of the story. While NVD or CVE.org provides official descriptions and affected version ranges, they rarely answer operational questions:
* *Is there a working exploit available?*
* *Are practitioners actively discussing practical workarounds?*
* *Is there evidence of internet-wide exploitation in the wild?*
To answer these, security analysts draw from multiple distinct sources:
| **Source** | **Role / Signal Type** |
| ----------------------- | ------------------------------------------------------------------ |
| **NVD / CVE.org** | Baseline vulnerability metadata & authority |
| **CISA KEV & CISA ADP** | Verified active exploitation & supplemental operational guidance |
| **FIRST EPSS** | Predictive probability of exploitation in the next 30 days |
| **GitHub & Reddit** | Public tooling, PoC code, and practitioner triage discussion |
| **X (Twitter)** | Fast, near-real-time researcher and vendor chatter |
| **GreyNoise** | Identification of internet scanner traffic (via CVE-filtered GNQL) |
| **VirusTotal** | Linked malware hashes, indicator objects, and community comments |
| | |
Crucially, **`vuln-research-agent` does not treat all sources as equal.** A entry in the CISA Known Exploited Vulnerabilities (KEV) catalog is authoritative evidence of in-the-wild attack activity. A GitHub repository description containing the string "PoC" is not. A GreyNoise IP returned from an unfiltered query is not a reliable CVE indicator.
The central design goal of `vuln-research-agent` is to collect evidence across these platforms while rigorously labeling uncertainty and filtering out noise.
### Architecture: One Engine, Three Entry Points
The project is built around a single research core written using Python's standard library. Because the CLI has zero external package dependencies, it runs anywhere without setup friction—whether in a local terminal, a CI/CD pipeline, or a SOAR playbook.
```
+-----------------------+
| User Input |
| (CVE ID / Product+Ver)|
+-----------+-----------+
|
v
+-------------------------------------+
| Agent Skill | MCP | Python CLI |
+------------------+------------------+
|
v
CVE & Product Resolver Core
|
+--------------+--------------+
| |
v v
+-------------------+ +--------------------+
| Primary Sources | | Intelligence & Social
| NVD, CVE.org, | | GitHub, Reddit, X, |
| CISA KEV, EPSS | | GreyNoise, VT, etc |
+---------+---------+ +----------+---------+
| |
+--------------+--------------+
|
v
Validation & Evidence Labeling
|
v
+-------------------------------------+
| Output Formats: |
| ASCII | Vertical | HTML | Text | JSON|
+-------------------------------------+
```
### Scope & Operational Philosophy
`vuln-research-agent` is strictly an **evidence collector and triage assistant**.
* It **does not** scan your internal infrastructure.
* It **does not** execute exploit code.
* It **does not** replace human decision-making.
Its goal is to eliminate the tedious 20 minutes of tab-switching and searching, presenting defenders with a validated, source-attributed starting point for informed decision-making.
## Getting Started
Here are the quick 4-step getting-started instructions for your blog post, including AI harness integration:
#### Step 1: Clone the Repository
Clone the repository locally. Since `vuln-research-agent` uses Python's standard library, there are no heavy external package dependencies to install:
Bash
```
git clone https://github.com/pbssubhash/vuln-research-agent.git
cd vuln-research-agent
```
#### Step 2: Set Optional API Keys
Export API keys for third-party threat intelligence providers (like GreyNoise or VirusTotal) to enable enriched scanning and indicator extraction:
Bash
```
export GREYNOISE_API_KEY="your_key"
export VIRUSTOTAL_API_KEY="your_key"
```
#### Step 3: Run via the CLI
Trigger the core research engine directly from your terminal using a CVE ID or product name to get a consistent 12-field triage report:
Bash
```
python3 main.py --cve CVE-2024-3094
```
#### Step 4: Connect to an AI Harness (MCP / Agent Skill)
Plug `vuln-research-agent` into an AI client or agent harness like Hermes by exposing its built-in MCP server or loading the Agent Skill:
* Via MCP: Register the server in your client's config file (e.g., `mcpServers` in Hermes or Claude Desktop):
JSON
```
"vuln-research": {
"command": "python3",
"args": ["/path/to/vuln-research-agent/mcp_server.py"]
}
```
* Via Agent Skill: Copy `skills/vuln-research` (or `.claude/skills/` / `.hermes/skills/`) into your AI agent's skill directory so the LLM automatically learns how to validate sources and invoke `research_cve`.
For more instructions, check
