vulkro verify
Check another scanner's SARIF results against Vulkro's proof.
Command reference
Generated from vulkro verify --help (vulkro 0.36.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.
Check another scanner's SARIF results against Vulkro's proof.
vulkro verify [OPTIONS] <RESULTS.SARIF>
Arguments
| Argument | Description |
|---|---|
<RESULTS.SARIF> | The SARIF 2.1.0 file to verify. |
Options
| Flag | Description |
|---|---|
--offline | Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set. |
--path <PATH> | The repository the results were produced on (default: current directory). Relative result paths resolve against it. Default: .. |
-f, --format <FORMAT> | Output format: table (default), json (the vulkro-verify/1 report) or sarif (the input log, annotated) Default: table. |
-q, --quiet | Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged. |
--no-color | Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb. |
-h, --help | Print help (see a summary with '-h') |
Full vulkro verify --help
Check another scanner's SARIF results against Vulkro's proof.
Verify third-party SARIF 2.1.0 results (another scanner, an LLM security scanner, an AI assistant's security review) against Vulkro's deterministic proof. Each result is mapped to a vulnerability family (its CWE first, then its rule id, then its message), the repository is scanned ONCE, and every result gets one verdict:
proven a Vulkro finding of the same family sits at or within 3 lines of the result and carries machine-checkable proof; the proof chain, the entry point and the risk model's actor, asset and severity are attached. not-provable Vulkro analysed the location and holds no proof; the reason says what it found instead (a heuristic-only finding, an adequate guard, a parameterised query or other neutraliser, no recognised source, no flow). not-examined outside this build's coverage (a language it does not read, a skipped or missing file, an unmapped family); the reason comes from the scan's coverage block.
`--format sarif` re-emits the input log with every result annotated (`properties["vulkro.verdict"]`, `vulkro.proof`, `vulkro.severity`, ...). Deterministic and offline; never edits a file.
Exit codes: 0 = verified, no result proven; 1 = at least one result proven; 2 = error (unreadable or invalid SARIF, unscannable path).
Usage: vulkro verify [OPTIONS] <RESULTS.SARIF>
Arguments:
<RESULTS.SARIF>
The SARIF 2.1.0 file to verify
Options:
--offline
Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set
--path <PATH>
The repository the results were produced on (default: current directory). Relative result paths resolve against it
[default: .]
-f, --format <FORMAT>
Output format: table (default), json (the `vulkro-verify/1` report) or sarif (the input log, annotated)
Possible values:
- table: Human-readable verdict table (default)
- json: The `vulkro-verify/1` JSON report
- sarif: The input SARIF log with every result annotated
[default: table]
-q, --quiet
Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged
--no-color
Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb
-h, --help
Print help (see a summary with '-h')