vulkro serve
Opens the local console in your browser at http://127.0.0.1:8723. Everything runs on this machine.
vulkro serve
vulkro scan . --web # scan, save, then open the console
The console shows every scan saved with vulkro scan --save (or --web), across all your repositories. See Local console for the tabs and views.
Flags
| Flag | Description |
|---|---|
--port <PORT> | Port to bind. Default 8723; if taken, the OS picks a free one. |
--host <HOST> | Interface to bind. Default 127.0.0.1. Use 0.0.0.0 for a team self-host. |
--no-browser | Do not open the browser. |
Access token
The console always requires a token. By default a new random token is created on each start and put in the printed URL (http://127.0.0.1:8723/?token=...); opening that link signs the browser in. Anyone with the link can use the console until you stop the server.
| Variable | Effect |
|---|---|
VULKRO_SERVE_TOKEN | Use this token instead of a random one. Sign in at the console root, or send Authorization: Bearer <token> from scripts. |
VULKRO_SERVE_ALLOWED_HOSTS | Extra host names the console answers to, comma-separated (for a reverse proxy or a real hostname). |
Requests without the token get HTTP 401. Requests from another web page's origin, or with an unknown Host, get HTTP 403.
Share with a team
export VULKRO_SERVE_TOKEN="$(openssl rand -hex 24)"
vulkro serve --host 0.0.0.0 --no-browser
The token travels over plain HTTP, so put a TLS reverse proxy in front on any network you do not fully trust, and list its hostname in VULKRO_SERVE_ALLOWED_HOSTS. The token is shared, not per user. For per-user roles, scheduled scans and pull-request checks, use Vulkro Cloud.
The console never sends your source, paths or findings anywhere. With VULKRO_OFFLINE=1 it makes no outbound call at all.
Stop it with Ctrl-C.
Exit codes
0 clean shutdown. 2 bind failure or server error.
See also: Baselines.