vulkro ai
Choose and test the local AI model used by the advisory --ai features.
vulkro ai setup # install Ollama (asks first), pick a model, self-test
vulkro ai setup --model qwen2.5-coder:7b --yes # same, no prompts (CI)
vulkro ai status
The AI layer is opt-in and advisory. It never changes a finding, a severity, the JSON / SARIF / SBOM output or an exit code. The default model runs locally through Ollama, so nothing leaves your machine. A local model still works under VULKRO_OFFLINE; a cloud endpoint is refused.
The choice is saved in ~/.vulkro/scans.db. There is no config file, and an API key is never written to disk.
Subcommands
| Subcommand | What it does |
|---|---|
setup | Wizard: install Ollama if missing (after a y/N), recommend a model, pull it, self-test, save. Flags: --model, --url, --yes, --byok (cloud, key from VULKRO_AI_KEY), --no-install. |
list | Installed models plus the recommended set. --format json available. |
use <MODEL> | Set the active model. --pull pulls it if missing, --url changes the runtime. |
pull <MODEL> | Download a model. |
status | Current model, runtime, reachability, offline mode, licence. --format json available. |
test | Self-test the active model. |
off | Turn AI off. The model choice is kept. |
ask <QUESTION> [PATH] | Scan, then answer one question grounded in the scan. |
chat [PATH] | Interactive chat grounded in the scan. |
targets [PATH] | List the code an AI second pass should look at. Calls no model. --explain, --max-targets <N>. |
log [PATH] | Show past AI interactions for this project (.vulkro/ai/sessions.jsonl). |
export [PATH] | Zip a security digest and AI history for another tool. -o sets the file. |
skill [PATH] | Write a findings digest into AGENTS.md, CLAUDE.md and .cursor/rules/vulkro.mdc (only the Vulkro block). |
Recommended models
| Model | Size | Licence |
|---|---|---|
qwen2.5-coder:7b (default) | 4.7 GB | Apache-2.0 |
phi4-mini:3.8b (small machines) | 2.5 GB | MIT |
qwen2.5-coder:1.5b | 1.0 GB | Apache-2.0 |
These can be pulled automatically. Any other model you pull yourself and accept its licence.
Which model runs
Highest priority first: per-run flags (--ai-model, --ai-url, --no-ai), then VULKRO_AI_MODEL / VULKRO_AI_URL, then the saved choice, then the default.
--ai on other commands
| Command | What --ai adds |
|---|---|
explain | A plain-language explanation for this code. |
fix | AI fixes where no template applies, kept only if a re-scan confirms them. |
diff | A summary of the security change. |
inspect | Why each flagged shape is suspicious. |
respond, slopcheck | Per-package or per-name notes. |
triage | Advisory triage verdicts (--ai-model, --ai-url, --no-ai). |
Exit codes
0 success, 2 error (runtime unreachable, model missing, bad arguments). ai targets exits like a scan: 1 when findings are reported.
See also: Offline mode.