vulkro triage

Runs a normal scan, then asks a model for an advisory second opinion on the findings a deterministic scan cannot settle on its own.

vulkro ai setup              # one time: install the local runtime and model
vulkro triage .
vulkro triage . --format json > triage-advisory.json

It looks at intent-class findings (paid-feature bypass, over-exposed personal data, whether a one-off script is reachable, source trust) and findings whose reachability the scan could not confirm.

Every verdict is labelled advisory and non-deterministic. It never changes a finding, a severity, the scan JSON or the exit code of vulkro scan. For CI gates, use vulkro scan.

Model

By default it uses a local model served by Ollama at http://127.0.0.1:11434/v1 (qwen2.5-coder:7b), so nothing leaves the machine and no key is needed. It still works under VULKRO_OFFLINE=1.

Precedence, highest first: the flags below, then VULKRO_AI_MODEL / VULKRO_AI_URL, then the saved vulkro ai use choice, then the local default.

To use a cloud endpoint with your own key, pass --ai-url and set VULKRO_AI_KEY (an Anthropic URL also accepts VULKRO_TRIAGE_API_KEY or ANTHROPIC_API_KEY). Cloud endpoints are refused under VULKRO_OFFLINE=1. Keys are never written to disk.

Flags

Flag	Description
--ai-model <MODEL>	Model tag for this run. --model is an older alias.
--ai-url <URL>	OpenAI-compatible runtime URL.
--no-ai	Turn the AI layer off (the command then exits 2).
-f, --format <FORMAT>	table (default) or json.

The JSON is an envelope with "advisory": true, the model and provider, ai_endpoint_class (local or cloud), and the verdicts array.

Exit codes

0 nothing needed triage. 1 advisory verdicts reported. 2 AI layer off, local runtime or model missing, cloud endpoint while offline, missing key, bad path or API failure.

See also: Evidence and AI, Offline mode.