██████╗ ██████╗ ██████╗ ██╗ ██╗██╗ ██╗███████╗
██╔════╝██╔═══██╗██╔══██╗██║ ██║██║ ██║██╔════╝
██║ ██║ ██║██████╔╝██║ ██║██║ ██║███████╗
██║ ██║ ██║██╔══██╗╚██╗ ██╔╝██║ ██║╚════██║
╚██████╗╚██████╔╝██║ ██║ ╚████╔╝ ╚██████╔╝███████║
╚═════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚══════╝
AI-Augmented CVE Intelligence & Defense CLI
CORVUS is a terminal-based cybersecurity tool that pulls CVE data from NVD, adds EPSS and CISA KEV context, and uses large language models to produce structured defensive analysis from the command line.
- Category Browser — Browse CVEs by domain: Web, Mobile, Cloud, OS/Kernel, Network, Database, IoT, Cryptography
- AI-Powered Analysis — 5-section defensive breakdown per CVE: Technical Analysis, Attack Vector Logic, Mitigation, Patch Logic, Threat Context
- Threat Index — Custom 0–100 risk score combining CVSS, EPSS, and contextual factors
- CISA KEV Integration — Instantly flags CVEs actively exploited in the wild
- EPSS Scoring — Exploitation probability percentile from FIRST.org
- CVSS Breakdown — Visual Attack Vector, Complexity, Privileges, Impact rendering
- Live Model Selection — Fetches real-time free model lists from Groq and OpenRouter at setup
- HTML Reports — Dark-themed, professional security reports via Jinja2
- Prompt Handling Safeguards — NVD description fields are sanitized and isolated in
<nvd_data>blocks before LLM submission - Local Key Storage — API keys stored in
~/.config/corvus/keys.env - 24h Cache — Reduces redundant NVD API calls
- Multi-language Analysis — LLM output in English or Turkish
corvus/
├── main.py # CLI entry point & routing
├── core/
│ ├── config.py # Secure config management (XDG, chmod 600)
│ ├── setup_wizard.py # First-time setup & model selection
│ ├── nvd_client.py # NVD 2.0 API client with retry logic
│ ├── epss_client.py # EPSS exploitation probability client
│ ├── kev_client.py # CISA Known Exploited Vulnerabilities client
│ ├── llm_client.py # Unified Groq / OpenRouter streaming interface
│ └── cache.py # Filesystem cache with 24h TTL
├── analysis/
│ ├── prompt_builder.py # Defensive prompts + injection sanitization
│ ├── risk_engine.py # LLM-based Threat Index calculator
│ └── report_builder.py # Jinja2 HTML report generator
├── ui/
│ ├── banner.py # ASCII banner & status diagnostics
│ ├── display.py # Rich-based terminal UI
│ └── interactive.py # Category browser & CVE selector
├── templates/
│ └── report.html # Dark-mode HTML report template
└── i18n/ # Localization strings (EN / TR)
- Python 3.11+
- A free Groq or OpenRouter API key
- (Optional) A free NVD API key for higher rate limits
- Tested on Linux. Windows support is not currently claimed.
git clone https://github.com/SerhatYavuz/corvus.git
cd corvus
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtpython3 main.pyOn first run, the setup wizard launches automatically:
- Select LLM provider (Groq / OpenRouter)
- Enter your API key — validated live
- Choose from real-time fetched free model list
- (Optional) Enter NVD API key
- Select analysis output language (English / Turkish)
After setup, the category browser opens directly.
# Default — opens category browser
python3 main.py
# Analyze a specific CVE
python3 main.py CVE-2021-44228
# Generate HTML report
python3 main.py CVE-2021-44228 --report
# Search NVD by keyword
python3 main.py --search "log4j"
# Batch analysis from file (one CVE ID per line)
python3 main.py --batch cve_list.txt
# Force English analysis output
python3 main.py CVE-2021-44228 --lang en
# Re-run setup wizard
python3 main.py --setup
# Bypass 24h cache
python3 main.py CVE-2021-44228 --no-cacheBrowse CVEs by category:
> 🌐 Web & Application
📱 Mobile
🖥️ OS & Kernel
☁️ Cloud & Container
🔌 Network & Protocol
🗄️ Database
📡 IoT & Embedded
🔐 Cryptography & Auth
🔴 Latest Critical
🔍 Search by keyword
📋 Enter CVE ID
⚙️ Change Model / Provider
✖ Exit
Each CVE analysis produces:
┌─ CVE-2021-44228 │ 🔴 CVSS 10.0 │ CRITICAL ─────────────────┐
│ Apache Log4j2 Remote Code Execution via JNDI lookup │
│ Published: 2021-12-10 CWE-502 │
└───────────────────────────────────────────────────────────────┘
┌─ Threat Index ────────────────────────────────────────────────┐
│ ████████████████████ 97/100 🔴 CRITICAL │
│ ⚠ ACTIVELY EXPLOITED (CISA KEV — added 2021-12-10) │
│ CVSS: 10.0 │ EPSS: 99.7% (99th percentile) │
│ AV: Network AC: Low PR: None UI: None │
└───────────────────────────────────────────────────────────────┘
┌─ 1. Technical Analysis ───────────────────────────────────────┐
│ [LLM-generated defensive analysis] │
└───────────────────────────────────────────────────────────────┘
... (5 sections total)
- Stored in
~/.config/corvus/keys.env— never in the project directory - On Linux/POSIX systems, file permissions are restricted on save
- Never hardcoded, never logged
External CVE data is treated as untrusted before reaching the LLM:
# Injection patterns stripped from NVD descriptions
_INJECTION_RE = re.compile(
r'(ignore\s+(all\s+)?(previous|prior|above)?\s*instructions?'
r'|forget\s+(everything|all|your\s+instructions)'
r'|you\s+are\s+now|new\s+persona|\bact\s+as\b'
r'|\[\s*system\s*\]|<\s*system\s*>|jailbreak)',
re.IGNORECASE,
)NVD data is then wrapped in <nvd_data> XML tags and the system prompt instructs the LLM to treat that block as raw external content. This is a defensive measure, not a complete guarantee against prompt injection.
User-selected model IDs are sanitized via regex before writing to config:
_MODEL_ID_RE = re.compile(r"[^\w/:.\-]")The system prompt enforces:
- No attack code generation
- Defensive perspective only
- Structured output format only
Keys, cache, and virtual environments are excluded from version control.
| Source | Data | Endpoint |
|---|---|---|
| NVD 2.0 | CVE details, CVSS, CPE | services.nvd.nist.gov |
| FIRST EPSS | Exploitation probability | api.first.org |
| CISA KEV | Actively exploited CVEs | cisa.gov |
| Groq | LLM inference | api.groq.com |
| OpenRouter | LLM inference (free tier) | openrouter.ai |
- Fast inference, free tier available
- Get key: https://console.groq.com
- Recommended models:
llama-3.3-70b-versatile,mixtral-8x7b-32768
- Access to 50+ free models
- Get key: https://openrouter.ai
- Free models fetched live at setup
Model list is fetched live at setup time — always reflects the current free tier.
Pull requests are welcome. For major changes, open an issue first.
- Fork the repository
- Create a feature branch (
git checkout -b feature/my-feature) - Commit your changes (
git commit -m 'Add my feature') - Push to the branch (
git push origin feature/my-feature) - Open a Pull Request
Please ensure:
- No API keys or secrets are committed
- New features include defensive security considerations
- Code follows the existing module structure
For educational and defensive security purposes only.
CORVUS is intended exclusively for:
- Security researchers and analysts
- System administrators auditing their own infrastructure
- Students and professionals studying vulnerability management
- Red/Blue team exercises on systems you are explicitly authorized to test
CORVUS does NOT:
- Generate exploit code or attack tools
- Facilitate unauthorized access to systems
- Provide offensive weaponization of vulnerabilities
By using CORVUS, you agree that:
- You are solely responsible for how you use this tool
- You will only analyze systems and CVEs within your legal authorization
- The author(s) bear no liability for misuse, damages, or legal consequences arising from use of this software
- This tool is provided "as is" without warranty of any kind
Unauthorized use of vulnerability intelligence to attack systems you do not own or have explicit permission to test may violate laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the EU Directive on Attacks Against Information Systems, and equivalent legislation in your jurisdiction.
This project is licensed under the MIT License — see the LICENSE file for details.
Serhat Yavuz — @SerhatYavuz