ChatCVE

ChatCVE is an open-source AI-powered DevSecOps platform that helps security teams triage, analyze, and manage container image vulnerabilities. It scans images directly from container registries with Syft + Grype, and ships a streaming AI security analyst — powered by your choice of LLM (OpenAI, Azure OpenAI, Anthropic, Bedrock, Gemini, or local models via Ollama) — that answers questions about your scan data in plain English. - Streaming AI Security Analyst - Tool-calling SQL agent (LangChain) that queries your scan database and streams answers in real time, rendered as Markdown with tables - Bring Your Own LLM - OpenAI, Azure OpenAI, Anthropic, AWS Bedrock, Google Gemini, or fully offline via Ollama - Registry-Direct Scanning - Scans images straight from Docker Hub, ECR Public, GCR and other registries via Syft (SBOM) + Grype (CVE matching) — no local Docker required - Interactive Dashboard - Real-time security metrics with auto-refresh, weighted risk scores, and exploitable CVE detection - CVE Explorer & Scan Management - Searchable CVE database, scan bundling, live progress/logs, bulk operations, and JSON export - Multi-Source Input - Type image references or upload text files with one image per line - User Authentication - JWT-based auth with role-based access control - External Integrations - GitHub Advisory Database and NVD API support Access ChatCVE at http://localhost:3000. Docker deployment automatically installs Syft, Grype, and all dependencies. Sign-in: this app keeps its own accounts. Each member signs up or signs in inside the app with an app username and password; the hub remembers each member's session. ChatCVE is the open-source project jasona7/ChatCVE (https://github.com/jasona7/ChatCVE) by jasona7, released under Apache-2.0. Ion packages it unmodified from commit e13dda3d2a25, adding only a manifest, an icon and a start script.

Written by jasona7, published to Oikou by Ben Grande.

• ★ 23 stars on GitHub
• Licence: Apache-2.0
• Built from commit e13dda3d2a25

View the repository on GitHub

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

Internet

It asks to reach these hosts, and no others:

• nvd.nist.gov
• fonts.googleapis.com
• stackpath.bootstrapcdn.com

Containers on your Personal Cloud’s computer

Can see the containers on your Personal Cloud’s computer, their settings and logs (which may hold passwords): Shows your Docker containers, images and their logs

You choose the level on your Personal Cloud, and can give less. It never sees your Personal Cloud’s own containers or other apps’ ones, and cannot create containers with your folders or extra privileges.

Personal Cloud tools

None. It uses nothing from your Personal Cloud beyond its own storage.

Notifications

It does not send push notifications.

Storage

Up to 512 MB on your Personal Cloud.

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add