CodexPluginStats
← Plugin catalog
Developer Tools

VulKill Security

GOKCE BARAN KARAKAMIS v1.2.4

AI pentest&mobile&web&code

Create a free account to save this plugin.

From the developer

Declared capabilities

  • Inspect 12 security domains (260+ controls)
  • Run authorized source-code and live website scans
  • Check credits and estimate scan coverage

Cost & access

VulKill is a subscription security-scanning service with prepaid scan credits. Customers purchase plans or additional credits through the external VulKill website and its Paddle checkout. This MCP plugin reads the connected account balance and consumes available credits only when an authorized scan is started. It does not expose checkout, fund-transfer or card-processing tools and does not collect payment-card details in ChatGPT.

Declared limitations

  • Unauthorized target. Explain that VulKill only supports security analysis of assets the user owns or is explicitly authorized to test. Do not invoke vulkill_start_scan or vulkill_auto_scan without authorization, and do not invent target ownership verification.
  • Purchasing credits is outside the MCP tool set. Explain that paid plans and extra credits are purchased through the official VulKill website and its checkout. Do not invoke a scan to simulate a purchase, request card details, or claim that payment succeeded.
  • Production changes are outside this connector. Explain that VulKill provides security analysis and reports; these MCP tools cannot apply fixes, push commits or deploy to production. Offer report-based remediation guidance without claiming a server was modified.

Onboarding example

View onboarding source →

Sources & dates

Developer declarations; not independently tested. Listing last checked Nov 10, 2026. Package observed Nov 10, 2026.

View package source →

Description

From the marketplace listing

VulKill inspects source codebases and verified live websites across 12 comprehensive security domains (260+ security controls): (1) Auth, Session & Access Control (IDOR/BOLA/BFLA/JWT/OAuth2/Multi-Tenant), (2) Business Logic, Payment/Wallet & Race Conditions (Double-Spend/TOCTOU), (3) Code Injection & RCE (SQLi, NoSQLi, Command Injection, XSS, SSTI, XXE), (4) Network, SSRF & File System (CSRF, CORS, Path Traversal, ZipSlip), (5) Leaked Secrets, API Keys & Git History, (6) Supply Chain, SCA/CVE & SBOM, (7) AI, LLM & MCP Agent Security (Prompt Injection, Tool Abuse), (8) Web3, Smart Contracts, Wallet Blind Signing & Cryptography, (9) Containers, Kubernetes, Cloud & IaC, (10) Mobile (APK/IPA) & Desktop (Electron/Tauri), (11) Deep AST Taint Tracking, Z3 Symbolic Proof & Binary Hardening, and (12) Live Website Security Testing + 3-Layer Real-World Impact Triage (False-Positive Elimination, Exploitability Proof & Copy-Paste Remediation Patch). Connect your own VulKill account, review the requested permissions, and inspect your credits before scanning. New members can complete membership and grant MCP access on one consent screen after signing in. Scan coverage depends on the supplied files, verified target, and selected mode; the completed report identifies the checks actually performed. Source-code scans require file contents, not a local path or repository URL alone. Live website scans require verified ownership and explicit authorization. Read-only planning and report tools do not start scans or spend credits.

Language: English · Automatically detected from descriptions.

ChatGPT marketplace listing ↗Website ↗Privacy policy ↗Terms ↗Support ↗

Changes

No changes recorded yet. Follow this plugin to keep track of future changes.

First seen Nov 10, 2026. Last seen Nov 10, 2026.

Keywords

Files & skills

File archives

Plugin package9 files · 17 KBBrowse files →
Skill instructions
get-started2.32 KB

View saved version →

---
name: get-started
description: Connect a VulKill account, inspect the security catalog and credits, and prepare authorized source-code or live website scans.
---

# Getting started with VulKill Security

1. Use the host's VulKill OAuth connection. If sign-in is needed, let the user sign in with an offered identity method and review the requested permissions. For a new member, the site combines membership terms and MCP permission in one explicit consent screen. A website login alone does not install or authorize the host connector. Never request passwords or tokens in chat.
2. Call `vulkill_ai_guide` for the current workflow, modes, requirements and liability statement. Call `vulkill_capabilities` with `query: "all"` when the user asks for all 12 domains and all 260 controls; an empty query returns an overview. Catalog scope is not proof of executed tests.
3. Call `vulkill_wallet_status` for the connected user's actual credits. Use `vulkill_credit_usage` for the current period's usage. Do not describe the account as a demo or reviewer account unless it actually is one.
4. Ask which authorized source contents or verified HTTPS target the user wants to scan. A local filesystem path or GitHub repository URL alone does not transfer files. For website ownership verification, follow the guide's target page/API process. Use `vulkill_estimate_scan` for a read-only estimate; it starts no job and charges no credits.
5. Before calling `vulkill_start_scan`, present the current liability statement and obtain the user's explicit acceptance for the specific scope. Do not accept on their behalf or infer acceptance from signing in. Send actual sourceFiles or a verified targetUrl, the correct authorizationScope, and a stable idempotencyKey. Respect the server's limits and returned errors.
6. Use `vulkill_get_scan_status` to follow the returned scanId and `vulkill_list_reports` for saved account reports. An accepted request, credit reservation or available engine is not proof of completion. Report only actual findings and coverage; zero findings is valid. Never fabricate results or claim all domains ran.
7. `search` searches capabilities and the connected account's saved reports. Pass returned IDs to `fetch`; cap- IDs represent catalog entries, while report IDs represent scan reports. Explain which record type was returned. If no report matches, say so.

Release notes

Version 1.2.4: combines new VulKill membership and MCP consent after sign-in in all 21 site languages; refreshes the consent screen to match the app; adds the 12-domain Claude listing description; corrects review expectations for catalog queries, read-only estimates, authorized scanning, usage and search/fetch. Renames the read-only planning tool to vulkill_estimate_scan while preserving the previous name as a compatibility alias. OAuth endpoints and requested scopes are unchanged. Clarifies the existing commercial license for this SaaS client connector; the Community edition keeps its separate license.

Declared in the saved package. Remote tools may change independently.

Package details

Publisher declarations from the archived package. These are separate from our research and the live service's terms.

Package license
SEE LICENSE IN LICENSE.txt
Package author
VulKill Security
Keywords
See keywords
Listing translations
tr-TR
Getting started skill
./skills/get-started/SKILL.md
Commerce declaration
Supports commerceThis does not establish whether access is free or paid.
Review scenarios
5 positive · 3 negativeScenario counts, not test results.

Declared capabilities

  • Inspect 12 security domains (260+ controls)
  • Run authorized source-code and live website scans
  • Check credits and estimate scan coverage
  • Search capabilities and retrieve account scan reports

Package observed Nov 10, 2026.

plugin.json
Technical details
First seen
Nov 10, 2026 · 12:00 UTC
Last seen
Nov 10, 2026 · 18:00 UTC
Collection status
Collected

plugin_asdk_app_6aea7be482bc8191a19ee6b24968802c

Download plugin data (JSON)

Plugin details: served from cache. Prepared . Refreshed when plugin data changes or after 6 hours. Your account and Follow status are live.