vulkro aggregate

Link evidence-graph exports from two or more repositories and list the calls in one repo that reach an endpoint in another.

vulkro scan ../api      --format evidence-graph > api.json
vulkro scan ../frontend --format evidence-graph > frontend.json
vulkro aggregate api.json frontend.json --format table

Each input comes from vulkro scan <repo> --format evidence-graph or vulkro discover <repo> --format evidence-graph. The match is deterministic: an outbound HTTP call whose normalised route and method match an endpoint in another repo becomes a candidate CrossRepoLink. Each link records both ends (repo, file, line), the shared route and method, the callee's auth posture and the reasons for the match. The summary counts links that reach an unauthenticated endpoint.

The links are candidates for a person or an AI coding agent to check, not verdicts. The same workflow is available as the evidence_graph and aggregate tools of vulkro mcp serve.

Flags

Flag	Description
-f, --format <FORMAT>	json (default): the full evidence-aggregate/1.0 document. table: a readable summary.

Exit codes

Code	Meaning
0	No cross-repo links found.
1	One or more candidate links reported.
2	Bad argument, unreadable file or bad JSON.

See also: Output formats: evidence-graph.