Installation & QuickStart

Get up and running with Vigolium in a few minutes, install, verify, and run your first scan.

Installation

Step 1: Install Vigolium Open Source

Native Installation (Recommended)

curl -fsSL https://vigolium.com/install.sh | bash

Installs ~/.local/bin/vigolium and adds it to your shell profile. The installer verifies the SHA-256 checksum before installing.

npm

npm install -g @vigolium/vigolium

Thin launcher that pulls the prebuilt binary for your platform as an optional dependency (Node 16+).

Bun

bun add -g @vigolium/vigolium

Installs the Vigolium launcher globally with Bun. Same prebuilt-binary launcher as the npm install path; Bun is just a faster package manager.

Homebrew

brew install vigolium/tap/vigolium

Installs the latest release from the Vigolium tap on macOS and Linux. Upgrade with brew upgrade vigolium.

Docker

docker pull j3ssie/vigolium:latest
docker run --rm j3ssie/vigolium:latest scan -h

The container entrypoint is the vigolium binary, pass any subcommand directly.

Build from Source

git clone https://github.com/vigolium/vigolium.git
cd vigolium
make build

Requires Go 1.27+, Bun 1.3.11+, git, and make. Always use make build (not go build), it injects version metadata.

Windows

npm install -g @vigolium/vigolium

Vigolium ships a native windows/amd64 build since v0.4.3. The npm launcher pulls vigolium.exe for you; alternatively download vigolium_<version>_windows_amd64.zip from the releases page and put vigolium.exe on your PATH.

The curl | bash installer and Homebrew are POSIX-only. vigolium update cannot self-update on Windows either — it names the zip to download instead. Windows on ARM installs the x64 build and runs it under emulation (Bun ships no bun-windows-arm64 target, so a native arm64 build would ship with the audit driver broken).

Shell-dependent features resolve the host shell automatically: an installed Git Bash / MSYS2 bash if present, otherwise PowerShell.

If ~/.local/bin was not already on your PATH, activate it without restarting your shell:

export PATH="$HOME/.local/bin:$PATH"

Step 2: Validate the installation

vigolium version
vigolium doctor

doctor reports any missing optional dependencies (a browser for SPA spidering, nuclei templates for the known-issue scan, bun/pi for agent drivers) and confirms your config is valid. Let it auto-install anything missing:

vigolium doctor --fix                          # auto-install/fix every failing check

--only accepts any of: nuclei, chrome, bun, claude, agent-browser, pi, piolium.

Everything Vigolium stores lives under ~/.vigolium/ (override with VIGOLIUM_HOME): config at vigolium-configs.yaml, scan DB at database-vgnm.sqlite, agent artifacts under agent-sessions/. Run vigolium init to create the workspace explicitly.

Step 3: Run a full scan

vigolium scan runs the full multi-phase pipeline (discovery → spidering → dynamic-assessment) using the balanced strategy by default:

vigolium scan -t https://example.com

Tune the depth/speed trade-off with a strategy preset:

vigolium scan -t https://example.com --strategy lite       # fast, dynamic-assessment only
vigolium scan -t https://example.com --strategy balanced
vigolium scan -t https://example.com --strategy deep       # thorough, more modules

--intensity quick|balanced|deep is a higher-level alias that also tunes the scanning profile. Not sure which mode to use? See Choosing a Scan Mode.

Step 4: One-shot stateless scan

For CI/CD pipelines, scripting, or quick ad-hoc checks where you don’t want anything left behind on disk, add --stateless and export results with -o. Vigolium spins up a temporary SQLite database, runs the requested phases, writes the output, then deletes the database on exit.

# Full pipeline, JSONL out, nothing persisted
vigolium scan --stateless -t https://example.com --format jsonl -o findings

# JSONL + HTML report, with content discovery
vigolium scan --stateless -t https://example.com --discover --format jsonl,html -o scan

# Single endpoint, no DB at all
vigolium scan-url https://example.com/api/users?id=1 -j

Multiple targets each get an isolated temp database and a per-host filename suffix so results don’t overwrite:

vigolium scan --stateless -T targets.txt --format jsonl -o results
# -> results-example.com.jsonl, results-test.example.com.jsonl, …

--stateless and --db are mutually exclusive. See Native Scan & Stateless Scanning for the full recipe book.

Step 5: Choose what to scan

# A file of targets, one URL per line
vigolium scan -T targets.txt

# From an OpenAPI / Swagger spec
vigolium scan -i api.yaml -I openapi -t https://api.example.com

# From a WSDL / SOAP service (or a live .svc/.asmx URL)
vigolium scan -i service.wsdl -I wsdl -t https://soap.example.com

# Pipe URLs from stdin
cat urls.txt | vigolium scan

# A raw HTTP request or curl command (auto-detected)
echo "curl -X POST -d 'user=admin' https://example.com/login" | vigolium scan-request

Supported input modes (-I): urls, openapi, swagger, wsdl (soap, svc), postman, curl, burpraw, burpxml, nuclei, har. An unknown -I value is rejected with a clear error (no silent fallback).

Step 6: Pick specific modules (optional)

# Only run XSS and SQLi modules (fuzzy match on module ID/name)
vigolium scan -t https://example.com -m xss -m sqli

# Filter by tag instead
vigolium scan -t https://example.com --module-tag injection

# List everything available
vigolium -M

Step 7: Get results out

By default findings stream to the console. For files or machine-readable output, use --format with -o:

# JSONL for scripting / CI
vigolium scan -t https://example.com --format jsonl -o results

# Self-contained HTML report
vigolium scan -t https://example.com --format html -o report

# Several formats at once
vigolium scan -t https://example.com --format jsonl,html -o scan

Flag	Effect
--format console	Human-readable terminal output (default)
--format jsonl / -j	One JSON object per line
--format html	Interactive ag-grid report (requires -o)
-o, --output	Output file path (base name; extension added per format)
--ci-output-format	JSONL only, no banners or color, ideal for CI
--silent	Suppress everything except findings

Step 8: Run a single phase

Use run <phase> (an alias for scan --only <phase>) when you only want one stage of the pipeline:

vigolium run discovery -t https://example.com    # content discovery only
vigolium run spidering -t https://example.com    # browser crawl only
vigolium run dynamic-assessment -t https://example.com

Phases: ingestion, discovery, external-harvest, spidering, known-issue-scan, dynamic-assessment, extension.

A note on persistence

vigolium scan writes results to a persistent SQLite database at ~/.vigolium/database-vgnm.sqlite, so you can browse them afterward:

vigolium traffic list      # ingested HTTP records
vigolium finding list      # discovered vulnerabilities

For one-shot runs that leave nothing behind (CI, ad-hoc checks), add --stateless and export with -o. See Native Scan & Stateless Scanning for the full set of recipes.

Updating & uninstalling

vigolium update                  # update binary + nuclei templates
vigolium update --check          # is there a newer release? exit code says so
vigolium update --dry-run        # show what would happen; change nothing
vigolium update --skip-templates # only reinstall the binary
vigolium update --install-dir /opt/bin
vigolium update -F               # skip the confirmation prompt

Homebrew, npm, and Docker installs are upgraded through their own tooling (brew upgrade vigolium / npm update -g @vigolium/vigolium / docker pull), not vigolium update.

Releases are signed, and the update verifies the signature (v0.5.3). vigolium update now updates in process with minisign verification rather than shelling out to an installer script, and the installers fail closed on a missing checksum or signature instead of proceeding. VIGOLIUM_UPDATE_BASE_URL points the whole mechanism at a mirror or an internal release host.

VIGOLIUM_AUTO_UPDATE only acts at an interactive terminal as of v0.5.3 — a CI job or an agent harness will not have its binary swapped mid-pipeline.

Next steps

• Choosing a Scan Mode, pick the right mode for your job.
• Native Scan & Stateless Scanning, CLI scan recipes.
• Scanning Strategies, strategies, profiles, pace.
• Authenticated Scanning, sessions and login flows.
• Setting Up the Agent, AI-driven autopilot and swarm scans.
• Configuration Reference, full configuration options.