Vulpine

Vulpine

A multi-agent vulnerability-development pipeline. Feed it a repository URL and
(optionally) a commit hash; the agents build the target, model its attack
surface, fuzz each feature, audit every function on the hot path, look for
security flaws, and attempt to chain the best bugs into an exploit.

Vulpine ships with multi-platform agent definitions so the same pipeline runs on
Claude Code, OpenCode, and Codex, letting you benchmark different
backend models on the same vulndev workflow.

Pipeline stages

A top-level vulpine-orchestrator agent (Claude Code) / /vulpine command
(OpenCode) runs the stages in order and handles fan-out at stage 5.

Skills / tools

Each skill is a Claude Code-format skill (SKILL.md + helpers) that lives in
its own upstream repository. Vulpine does not author skill content itself — it
just ships agents that reference skills by name. install-tools.sh clones
the upstream repos into tools/src/ and the deploy scripts symlink each
SKILL.md directory into the Claude Code / OpenCode skill search paths.

For OpenCode (which has no native skills concept), the deploy script also
populates ~/.vulpine/skills// so agent prompts can @-include the
same SKILL.md content.

For Codex, scripts/deploy-codex.sh generates user-scope custom agents under
~/.codex/agents/ from the Claude agent prompts and links the same upstream
skills under ~/.agents/skills/.

Layout

Quick start

After deployment:

- Claude Code: start claude in a working directory and run
  Use vulpine-orchestrator for https://github.com// at .
- OpenCode: start opencode and type /vulpine  [].
- Codex: start codex or run codex exec and explicitly ask it to spawn
  the vulpine-orchestrator custom agent for  [].

Each run writes its artifacts to ./run/-//.

Evaluating different backend…