| name | vulnavigator-web |
| description | Start a local out-of-tree VulNavigator Flask UI if the operator already has one. |
| argument-hint | |
| allowed-tools | ["exec","read"] |
| permissions | {"allow":["Exec(python)","Exec(python3)"]} |
Start a local Flask UI for VulNavigator only if the operator already has that script. It is not shipped in this git repository.
What this skill is not
- Not live MITRE ATT&CK / D3FEND MCP
- Not a substitute for
vuln-nav (use the vulnavigator skill for analysis)
- Not a public service. Bind to
127.0.0.1. Do not print LAN IPs from the machine.
The core CLI maps ATT&CK/D3FEND from src/vulnavigator/data/mappings.json. The local UI may append OSV.dev / Shodan InternetDB results. It does not query MITRE MCP.
Locate the UI
Search in this order; stop at the first file that exists:
$VULNAVIGATOR_WEB if setvulnavigator_web.py in the current workspace~/vulnavigator_web.py
If none exist, stop. Tell the user the Flask UI is out of tree and they should use vuln-nav analyze instead. Do not invent a path.
Use that script’s interpreter if a sibling web_venv exists; otherwise python3. Example:
python3 vulnavigator_web.py
Prefer --host 127.0.0.1 --port 5000 when the script accepts those flags. Otherwise assume http://127.0.0.1:5000.
Optional lookups (if the local UI implements them)
A local UI may call voraxx-mcp-server for:
- CVE lookup via OSV.dev
- host exposure via Shodan InternetDB
Do not advertise Nuclei; the local UI does not run it.
Usage to tell the user
- Open
http://127.0.0.1:5000
- Paste JSON, narrative, or a CVE
- Read the 11-section
vuln-nav case first. Optional lookup sections are labeled separately.
