vigolium — The Cyber Toolchain

vigolium v0.5.5

Sat, 24 Oct 2026 08:23:57 GMT

vigolium v0.5.5 adds HTTP/3 fuzzing, new fingerprint/hosts/dns subcommands, TSV output, and JSON schemas across core commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--http-version`, `--http3`, and `--http3-only` flags to `fuzz`, multiplexing over HTTP/3 → HTTP/2 → HTTP/1.1 with protocol reported as `pace.protocol`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `vigolium fingerprint` subcommand with `--depth light|standard|full` to store per-origin host facts, `vigolium hosts` subcommand with `--sans` and `--soft-404` flags to read stored host facts, and `vigolium dns` subcommand to resolve and store DNS records, with `dig` and `host` shims routing to it. • Adds `vigolium schema storage [table]` subcommand to describe tables, columns, and row counts, a `--usage` flag on any command, `vigolium schema flags -j` for machine-readable flag docs, and JSON schemas for `fuzz`, `replay`, `ingest`, `traffic body/headers`, `hosts`, `dns`, `fingerprint`, and `schema storage/flags`. • Adds `--format tsv` output option to `traffic`, `finding`, `endpoints`, `params`, `hosts`, and `dns` commands, and adds `--fields`, `--compact`, and `--max-output-bytes` flags to `fuzz`, `replay`, `endpoints`, `params`, `log ls`, `hosts`, and `dns`. • Adds `traffic --fields matches_not_found` and `--exclude-not-found` flags, plus new `uuid_short` and `response_headers` fields to the shared `--fields` system, with nearest-name suggestions on typos. • Adds `ingest -j` to list stored items and failure reasons, plus `--keep-blocked` to store WAF block pages. • Adds favicon mmh3 hash output (Shodan/FOFA compatible) alongside existing MD5 and SHA-256 hashes, and pins each origin's discovered protocol in `discovery.engine.protocol` with a dedicated `brute_force_concurrency` pool. • Adds `php2shell-version` passive module flagging vulnerable PHP 8.2–8.5 banners. • Record UUID flags now accept a unique 8+ character prefix, returning `ambiguous_id` on collision. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.5.4

Sun, 18 Oct 2026 08:53:05 GMT

Adds `oast.fallback_to_default` config key to auto-re-register against `oast.pro` when a custom OAST server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `oast.fallback_to_default` config key (default `true`) that automatically re-registers against `oast.pro` when the configured `server_url` does not respond, without forwarding the token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.5.3

Sat, 10 Oct 2026 13:58:04 GMT

vigolium v0.5.3 adds agent budgets, OAuth2 sessions, multi-tab crawling, finding lifecycle commands, and a new REST API v2 opt-in across 80+ new surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--max-commands`, `--token-budget`, and `--max-cost-usd` flags to cap agent run budgets (exit code 5 when exhausted).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--auth-file` to `agent swarm` and `agent autopilot` for supplying credentials to agentic runs. • Adds `--preflight-timeout` and `--no-preflight` flags to control agent provider ping behaviour. • Adds `agent triage --no-write` / `--no-probe` and an `inconclusive` verdict. • Adds `scan --dry-run` / `run --dry-run` to print the resolved scan plan without sending any traffic. • Adds `fuzz -r`/`--rate-limit` global request cap. • Adds `fuzz --fuzz new-param`, `--suffix`, and a builtin `params` wordlist. • Adds `--discovery-extensions` and `--discovery-max-depth` flags. • Adds `--known-issue-scan-templates` to run specific nuclei templates. • Adds `--format csv`, `junit`, and `github` report formats for CI pipelines. Breaking changes: • `schema_version` is now 2; scan commands print one scan document under `-j` instead of the previous structure. • `-j` on a scan no longer implies `--format jsonl`. • A `-j` document's `command` field is always the cobra path. • `import` and `js` now use the global `--format` instead of their own. • Remaining read commands print the `-j` envelope; use `--json-legacy-keys` to restore old keys. • `-j` output is compact by default; use `--pretty` to indent. • Color is automatic (`auto`) instead of always on. • `replay` and `fuzz` print a human view by default; `-j` is now one envelope. • `traffic -j` with tree/markdown/raw/burp output exits 2. • `agent audit` now requires `--source`. • An `--ext` extension that fails to load stops the scan; use `--ext-allow-failures` to restore the old behavior. • `ext lint` errors on missing handlers and exports. • Extension header objects are now case-insensitive, exposing `get`/`getAll`/`has`/`entries`/`raw` instead of the previous structure. • `project use` no longer auto-creates a project; pass `--create` explicitly. • `auth load` exits 1 on a failed login and runs the full scan login flow. • `auth totp` prints the bare code; JSON output is now behind `-j`. • `--fail-on`, `scan diff`, and `--new-since` now ignore dismissed findings. • `scan ` exits 2 as a mistyped subcommand. • `server` binds to `127.0.0.1` by default; a non-loopback ingest proxy now requires a token or allow-list. • `-S` on `server` and `ingest` is now a usage error. • `scan` / `run` with no target require `--all-records` to rescan the database. • `scan-url` / `scan-request` enforce scope without `-S`; the REST equivalent returns 422. • A scan whose every target is out of scope exits 1 with `no_targets_in_scope`. • A scan with no reachable targets exits 1 with `no_targets_reachable`. • `modules_run` now counts modules that executed; `modules_loaded` holds the old number. • `vigolium update` now updates in-process with signature verification. • `VIGOLIUM_AUTO_UPDATE` only acts at an interactive terminal. • `db export --format csv` now uses standard quoting and neutralizes formula injection. • An unknown `X-Project-UUID` header now returns 404 instead of creating a project. • `doctor` exits 1 when `not_ready`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.5.2

Sat, 03 Oct 2026 13:58:32 GMT

vigolium v0.5.2 adds scan completeness fields, new spidering config keys, auth-gating, and several new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `completeness`, `stop_reason`, and `phase_outcomes` fields to the scan row, REST object, and `--format jsonl` output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `reasons` and `limits` fields on `phase.finished` and `scan.finished` events, plus `stop_reason` on the scan line. • Adds `--require-auth` flag and `spidering.require_auth` config key so a failed login is fatal for that target. • Adds `--keep-db-on-error` flag to preserve a failed `-S` run's database under `~/.vigolium/recovered/`. • Adds `--glob-strict` flag for `--glob-db` reads, with `glob_sources` accounting naming every skipped file. • Adds `--max-output-bytes` (opt-in) flag on `finding`, `traffic`, and `db ls` commands. • Adds `--json-legacy-keys` flag to restore the per-command row arrays replaced by `items`. • Adds `spidering.interaction.*`, `spidering.identity_email_domain`, `spidering.graph_include_values`, and `spidering.max_capture_body_bytes` config keys. • Adds `make test-browser-conformance` target running a browser conformance suite with a launch precheck. • Enables the browser sandbox by default; `--browser-insecure` restores the previous posture. • Enables SIGTERM to cancel a scan the same way Ctrl-C does. • Makes `--events ndjson` own stdout exclusively, with events carrying a `seq` field and a terminal event written after finalization. • Exits 1 with `error.code: "export_failed"` when a requested output cannot be written, instead of warning. • Makes single-file `-o` outputs publish atomically, leaving the previous file intact on failure. Breaking changes: • The browser crawler no longer creates accounts, uploads or downloads files, and now cancels confirm() dialogs by default; `spidering.interaction.*` restores each behaviour individually. • Crawl graph filenames are now `crawl-graph---.json` (redacted and owner-only); any glob targeting the old filename pattern must be updated. • `-j` now emits one document per invocation with `items` as the only row array; scripts relying on the old per-command row array names must pass `--json-legacy-keys` or be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.5.1

Thu, 24 Sep 2026 17:02:33 GMT

vigolium v0.5.1 adds Claude 5 pricing, `reasoning_effort: max`, adaptive thinking, and prompt caching for Anthropic models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `reasoning_effort: max` for Anthropic, extending effort-level control to every provider that supports it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `agent.olium.max_tokens` config key, defaulting to `0` (provider default, 64000 on Anthropic); oversized values are ignored. • Adds Claude 5 family pricing (Fable 5.1/5, Opus 5.5/5, Sonnet 5) in audit cost estimates. • Enables adaptive thinking for Claude 4.6+ models. • Adds conversation-tail prompt caching on Anthropic, reducing input cost on long agent loops. • Surfaces skill `allowed-tools` to the model, with warnings for tools the run does not expose. Breaking changes: • `agent.olium.max_tokens` now defaults to `0` (provider default); previously set oversized values are silently ignored on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.5.0

Tue, 22 Sep 2026 03:05:07 GMT

vigolium v0.5.0 adds scratch cleanup, hygiene module controls, and scope-origin tracking across JSONL, export, and REST⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `vigolium kit tmp-clean` subcommand to collect abandoned vigolium scratch from the system temp directory left by interrupted runs, with `--max-age` (default 6h) controlling what counts as abandoned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--module-tag hygiene` and `--module-id ` selectors to target the new `hygiene` module tag. • Adds `dynamic-assessment.hygiene_modules` config key to force hardening advisories on at any intensity or off even at deep. • Adds `scans.scope_origin_mode` field, carrying the resolved host-scope mode through `--format jsonl`, `vigolium export`, and the REST scan object. • Adds `config.ResolveCLIOriginMode` as the single fallback chain read by the matcher, banner, summary, snapshot, and scan row. • Adds a `Host scope` reference section documenting how `--scope-origin` also selects stored records. • The 14 `hygiene`-tagged hardening advisories no longer run at the default intensity; they now require `--intensity deep`, `--module-tag hygiene`, or the `dynamic-assessment.hygiene_modules` config key. • A single-phase stateless scan (`run probe -t -S`) is several times faster (~0.78 s to ~0.12 s) due to bounded in-memory dedup tiers and executor drain improvements. • Startup is approximately 20 ms faster following the `go-runewidth` v0.0.27 to v0.0.30 upgrade. Breaking changes: • The 14 `hygiene`-tagged hardening advisories (including `express-session-audit`) no longer fire at the default intensity — scans relying on these findings at default intensity will no longer produce them without adding `--intensity deep`, `--module-tag hygiene`, or configuring `dynamic-assessment.hygiene_modules`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.4.9

Sun, 20 Sep 2026 14:10:26 GMT

vigolium v0.4.9 adds source-map ingestion, SSO-wall redirect halting, new HTTP record fields, and major `kit js-beautify` flag expansion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sourcemap-ingest` active module that fetches exposed source maps, secret-scans the recovered originals, and ingests their routes into the scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `http_records.target`, `root_uuid`, and `chain_truncated` fields — exposing the submitted target, O(1) chain-root lookup, and whether a redirect chain stopped short. • Adds `-o`, `--modules`, `--profile`, `--unpack-modules`, `--max-ast-nodes`, `--max-input-mb`, and `--deadline` flags to `kit js-beautify`; `-j` output gains `status`, `diagnostics`, and per-endpoint provenance. • Adds `max_unpack_input_mb` (default 16 MiB) to bound the source-level unpack pass independently of the AST node ceiling. • Adds shared `jstangle/sourcemap` package providing a single canonical definition of a map reference, sibling candidate, and parsed map. • Extends source-map detection to cover CSS, `eval` strings, `SourceMap`/`X-SourceMap` response headers, and unreferenced `.map` sibling files. • Redirects now halt at a login/SSO wall under every `--redirect-mode`, with each phase reporting the walls it hit and an example target. • Raises `maxBundleModules` default from 64 to 512, orders modules by endpoint likelihood before the cap, and gives each sub-scan its own AST node budget. Breaking changes: • `pkg/spitolas/loginsig` has moved to `pkg/authsig` — any code importing the old path will break. • `--record-redirect-chain` no longer gates request/response re-pairing, only hop rows — setups that relied on this flag to suppress re-pairing will behave differently. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.4.7

Fri, 18 Sep 2026 14:31:18 GMT

vigolium v0.4.7 adds targeted traffic body/header extraction, per-command file output, and exact URL filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `vigolium traffic body` and `vigolium traffic headers` subcommands to extract one side of a stored exchange to stdout or a file without re-sending the request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-o`/`--output` flag to `traffic -j`, `finding -j`, and `db ls -j` to write the result document to a file and print a receipt to stdout. • Adds `--url` flag to `traffic` and `db ls` for exact URL selection, repeatable and OR-ed, applied before pagination. • `db stats` now reports `path` and `size` fields for the source path and on-disk size. Breaking changes: • Pointing a read command at a missing `--db`/`$VIGOLIUM_DB_PATH` path no longer creates the database and returns `total: 0` — it now exits with `source_missing`. A foreign SQLite file that previously gained vigolium's tables now exits with `source_incompatible` instead. • Default concurrency is now 25 everywhere; previously the CLI, pace config, REST API, and discovery source used inconsistent values of 50, 40, 50, and 50. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.4.6

Sun, 13 Sep 2026 17:32:09 GMT

vigolium v0.4.6 adds `run probe` host sweeps, TLS fingerprinting, redirect-chain tracking, and a deterministic `surface_score` on every record.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `vigolium run probe` (aliases: `probing`, `httpx`, `alive`, `sweep`) for passive-only host sweeps — one request per target, no fuzzing, enabling `-T hosts.txt -c 20` to reach thousands of hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--tls-probe` to complete a TLS handshake per HTTPS endpoint and report negotiated version/cipher plus leaf certificate details (subject/CN, SANs, issuer, validity window, serial, MD5/SHA-1/SHA-256 fingerprints) under a `tls` key. • Adds `--redirect-mode off|same-host|same-apex|any` (default `any`) to control redirect-following scope, replacing the former `FollowRedirects`/`FollowHostRedirects` bool pair. • Adds `--record-redirect-chain` to store each followed redirect hop as its own `http_records` row chained through `parent_uuid` (on by default under `run probe`). • Adds `http_records.response_location` column storing a 3xx `Location` header verbatim, enabling `traffic --tree` to display redirect destinations without re-parsing stored response bytes. • Adds `http_records.surface_score` — a deterministic, absolute percentage of 17 attack-surface signals (auth boundary, non-standard port, dynamic origin, permissive CORS, leaked internals, API surface, input surface, etc.) written by the new `surface-scoring` passive module. • Adds `db ls --min-surface`, `--sort surface_score`, and a `SURFACE` column to `db ls`; exposes `min_surface`/`min_surface_score` on the records APIs and in `-j`/JSONL, CSV export, and `inspect_record`. • Adds `--export-only` on `scan`/`run` to limit `--format jsonl` output to chosen record types, reusing the `export --only` vocabulary. • Adds `traffic --group-by ` to count matched records by `host`, `method`, `status_code`, `response_content_type`, `source`, `scan_uuid`, `ip`, or `is_authenticated`, bounded by `--group-limit`. • Adds `--no-response` as an alias for `--omit-response` to skip storing response bodies on sweep runs. • Populates `http_records.technology` during a scan via the `surface-scoring` flush, which writes the full fingerprint-module stack onto every record for a host. • Adds `error.code: "source_incompatible"` for a valid SQLite file that is not a vigolium store, replacing the generic `failed` error. • Adds `spa` to the known tech tags so modules can gate logic on client-side-routing detection. • Adds `--json-legacy-keys` flag (and `VIGOLIUM_JSON_LEGACY_KEYS=1` env var) to restore the deprecated `records`/`findings`/`scans`/`rows`/`stats` envelope keys for callers still migrating. • Probe rows are labelled `probe` and filterable via `traffic --source probe`, making sweeps separable from full scans within the same project. • Registry grows to 207 active and 117 passive modules. Breaking changes: • `surface_score` is now a percentage of the 17-signal set rather than a 10-point-per-signal scheme; scores from earlier scans are not comparable to new ones. • The `-j`/JSONL envelope no longer emits the legacy `records`/`findings`/`scans`/`rows`/`stats` keys by default; callers must pass `--json-legacy-keys` or set `VIGOLIUM_JSON_LEGACY_KEYS=1` to restore them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.4.5

Fri, 04 Sep 2026 13:11:33 GMT

vigolium v0.4.5 adds NDJSON event streams, tool shims, batch ingest, and a stable machine-output envelope across all commands⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--events ndjson` to `scan`/`run`/`scan-url`/`scan-request` for a live NDJSON event stream on stdout emitting `scan.started`, `phase.started|progress|finished`, `waf.block`, `waf.pacing`, `finding.new`, `error`, and `scan.finished` events while the human console remains on stderr.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a repeatable phase qualifier to the pace dials — e.g. `--rate-limit known-issue-scan=20` — so individual phases can be capped independently without affecting other modules. • Adds `vigolium ffuf|nuclei|katana|gau|arjun` tool shims that accept each tool's own argv, print the translation, and run the native phase into the pinned database. • Adds batch ingest: `-i` is now repeatable and `--dir`/`--dir-glob` walk a directory, so N specs cost one process instead of N invocations. • Adds `vigolium version --json`, which reports `schema_version` and `db_schema_version` so a consumer can detect contract drift at startup. • Adds filter flags `--host`, `--path`, `--method`, `--status`, `--search`, `--from`/`--to`, `-n`, `--all-hosts`, and `--yes` to `import -B`, matching the filter set `traffic -B` already had. • Standardises exit codes across all commands: `0` success, `1` error, `2` usage error, `3` `fuzz --fail-on-match`, `4` `--fail-on` gate tripped. • Unifies machine output under one `-j` envelope — `{schema_version, command, project_uuid, db_path, total, offset, limit, items, query}` — for every command, with each command's old row key kept as a deprecated alias; `db stats -j` is no longer an exception. • Renames `--fuzz-wordlist` to `--discovery-wordlist` (old spelling kept as a deprecated alias) to eliminate collision with `vigolium fuzz -w`. • Adds `--templates-dir` flag to pin the `nuclei-templates` directory per run. • Enables `finding --push-to-burp` and `--to-repeater` to compose rather than being mutually exclusive, matching `replay` behaviour. Breaking changes: • Exit code `1` previously meant both 'scan crashed' and 'scan found something'; it now means only 'error'. Automation that tested `exit == 1` to detect findings must switch to `exit == 4` (for `--fail-on` gates) or `exit == 3` (for `fuzz --fail-on-match`). • The `-j` envelope schema changed for every command: each command's payload is now under a unified `{schema_version, command, project_uuid, db_path, total, offset, limit, items, query}` structure; drivers that read the old per-command row key must migrate (the old key is retained only as a deprecated alias). • Machine-output timestamps now carry exactly three fractional digits plus an epoch-millisecond sibling; consumers relying on microsecond-precision fractional timestamps will see a change in format. • `--fuzz-wordlist` is renamed to `--discovery-wordlist`; the old spelling is kept as a deprecated alias, so scripts using `--fuzz-wordlist` will still run but should be updated. • `-S` is now `--stateless` everywhere; on `server`/`ingest` the old meaning of `--scan-on-receive` is now a deprecated alias that emits a warning. • An unfiltered `import -B` is now refused unless `--all-hosts` is explicitly passed; existing scripts that called `import -B` without host filters will fail with a pre-flight count prompt. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.1.35-beta (Prerelease)

Wed, 17 Jun 2026 15:25:00 GMT

vigolium v0.1.35-beta adds `-T` target files, `sqlite` output, stateless scans, and intensity-driven scanning. • `-T/--target-file` repeats to merge multiple URL lists into a single scan run • `--format sqlite` exports findings to SQLite (requires `-S` and `-o` flags) • `-S/--stateless` enables stateless mode for `finding` and `traffic` commands, reading directly from a `.sqlite` database • `--intensity` flag controls module grouping with tiers: light, moderate, heavy, intrusive, balanced, quick, and deep • `vigolium audit` provides a top-level alias for stateless audits that auto-render an HTML report • `-m/--markdown` renders findings and traffic records as Markdown output • `--follow-subdomains` feeds in-scope subdomains extracted from JS bundles back into the scan (automatically enabled at `--intensity deep`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.1.25-beta (Prerelease)

Sun, 07 Jun 2026 13:10:19 GMT

Vigolium v0.1.25-beta adds SSRF/OS injection detections, `--ingest-proxy-port`, `--skill` overrides, and `/api/agent/scans/:uuid/cancel` endpoint • `http.Options.RawRequestTarget` request-line primitive for raw HTTP request construction in detection modules • New routing-based SSRF detection modules (`routing-ssrf`, `upgrade-routing-ssrf`) with OAST header fan-out via `oast-probe` • Three new OS command injection detection modules: results-based, out-of-band, and time-based blind • SSRF/proxy-confusion detection family: `ssrf-filter-bypass`, `ssrf-protocol-smuggling`, `open-redirect-confusion`, `reverse-proxy-path-confusion`, `cache-poisoned-dos` • `vigolium server --ingest-proxy-port N --proxy-mitm` for HTTPS-intercepting ingest proxy with auto-generated CA • `--skill`, `--skill-tag`, `--no-skill-filter` CLI flags for overriding attack-vector skill selection in agentic scans • Attack-vector skill playbooks (`xss-browser-confirm`, `idor-blast-radius`) materialized to `~/.vigolium/skills` • Runtime `agent` configuration reload without server restart • OpenRouter `provider_routing` knob + `extra_body` passthrough for OpenAI-compatible backends • `-P`/`--parallel` multi-target fan-out with isolated child processes, paired with `--split-by-host` or `--db-isolate` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium

vigolium v0.1.13-beta (Prerelease)

Sun, 24 May 2026 13:29:46 GMT

Vigolium v0.1.13-beta introduces autonomous AI agent modes, source-aware auditing, multi-tenancy and flexible input formats. • Adds `autopilot`, `swarm`, `query`, and `audit` AI agent modes with in-process olium runtime • Supports `--source` flag on agent modes for filesystem-level code analysis and deep static security audits • Introduces multi-tenancy via `project_uuid` with config merging (global → project → profile → CLI) • Enables flexible inputs including OpenAPI, Swagger, Postman, Burp XML, cURL, HAR, Nuclei, and stdin piping • Adds REST API server deployment shape with Fiber and Swagger UI alongside CLI and ingestor client • Supports SQLite (default) and PostgreSQL via Bun ORM for storage • Provides `console`, `jsonl`, and `html` output formats plus embedded ag-grid HTML report • Allows custom active/passive modules in JavaScript via Sobek engine and `vigolium.*` API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vigolium