Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Capital One VulnHunter

Free#25 of 27 in AI Code Security Scanners

Capital One VulnHunter: A self-hosted scanner that traces exploit paths, challenges findings, and verifies fixes. Ranked #25 of 27 in AI Code Security Scanners by our editors (6.8/10); pricing: Open source; best for experimental attacker-first code analysis.

6.8/10Editor score
Visit VulnHunter
Capital One VulnHunter6.8 Visit VulnHunter

At a glance

  • Editor score
    6.8 / 10
  • Pricing
    Open source
  • Best for
    Experimental attacker-first code analysis
  • Paid from
    Free
  • Founded
    2026 · McLean, Virginia, United States
  • Facts checked
    20 Oct 2026

  • Where it wins

    • Attacker-first analysis traces APIs, network messages and file uploads
    • Falsification workflow challenges suspected vulnerabilities with evidence
    • Test-driven remediation creates exploit demos and security tests

  • Where it doesn't

    • Requires Claude Opus and a Claude Code environment
    • Self-hosted deployment places setup and operation on your team
    • Integration focus is limited to Claude Code, Anthropic API and GitHub

Our verdict on Capital One VulnHunter

Capital One VulnHunter is an open-source, agentic AI security tool for mid-market and enterprise teams that want to analyze source code from an attacker’s perspective. It examines entry points from APIs, network messages and file uploads, then maps exploit paths and capabilities through application logic. Distributed under the Apache License 2.0, it runs as a self-hosted project across web, Windows, macOS, Linux and API environments, with Claude Code skills for hunting, fixing and verification.

Its standout workflow is designed to question its own findings rather than stop at detection. A multi-stage falsification process challenges suspected vulnerabilities, while evidence-backed remediation targets the relevant code. The test-driven workflow can create exploit demonstrations and security tests, and an independent read-only verification skill checks proposed fixes. Headless runtime support enables automated scans and GitHub issue creation, while batch scanning and a benchmarking harness support repeated analysis.

VulnHunter fits teams prepared to operate an open-source security project and provide access to Claude Opus and a Claude Code environment. Claude Code, the Anthropic API and GitHub are the named integrations, so organizations needing a broader prebuilt ecosystem may prefer another scanner. Support is provided through community channels and documentation. Teams seeking a conventional managed SaaS service, or a product with a longer operating history than this 2026-founded project, should consider alternatives; teams prioritizing exploit-path reasoning and test-based verification will find the narrower focus more suitable.

Your product? Our editors can test Capital One VulnHunter in depth and publish a review, labelled as paid · from $149/mo →

Capital One VulnHunter pricing

Plans Open sourceFree Free to use — no paid tier required for the core job.
See plans on github.com

Capital One VulnHunter fact sheet

Free planNot verified
Paid fromFree
Secrets detectionNot verified
Dependency scanningNot verified
IDE integrationsNot verified
CI integrationsNot verified
AI fix suggestionsYes
Deployment modelSelf_hosted
Supported languagesNot verified
DeploymentSelf-hosted
PlatformsWeb, Windows, macOS, Linux
SupportCommunity, Docs
Built forMid-market, Enterprise (editorial estimate)
Integrations3 integrations: Claude Code, Anthropic API, GitHub
PricingOpen source
Websitegithub.com
Facts checked20 Oct 2026

Capital One VulnHunter integrations

Capital One VulnHunter lists 3 integrations on its own site.

  • Claude Code
  • Anthropic API
  • GitHub

Alternatives to Capital One VulnHunter

See all Capital One VulnHunter alternatives →

Used Capital One VulnHunter? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Capital One VulnHunter for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — Capital One VulnHunter 6.8/10

Capital One VulnHunter is listed in our AI Code Security Scanners directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/capital-one-vulnhunter/"><img src="https://www.itechguides.com/best/badge/capital-one-vulnhunter.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update