Documentation

Subagents

The 5 multi-step workflows that run as their own agent.

A subagent is for work that needs several rounds and its own context: triaging a backlog, orchestrating an upgrade, reviewing a diff, assembling a compliance bundle, running an incident.

AgentWhat it does
bulk-triageParallel CWSS scoring across many vulnerabilities — each analysed independently, single consolidated .vulnetix/memory.yaml write at the end, output grouped by P1–P4 priority tiers.
compliance-bundlerEnd-to-end compliance bundle agent — CycloneDX SBOM + SPDX licenses + SARIF findings + OpenVEX/CycloneDX VEX, optional cosign signing, optional Vulnetix upload, manifest.json with SHA-256 sums, Markdown index.
dep-upgrade-orchestratorEnd-to-end dependency upgrade across all manifests — detect capabilities, scan for vulnerable deps, plan fixes ranked by patch-vs-major bump risk, apply per-manifest, run package-manager install, verify each fix, loop on conflicts via dep-resolve.
incident-responderFull SOC playbook agent for an actively exploited CVE — parallel sightings + KEV + IOCs + ATT&CK + fixes + remediation pull, capability-aware detection-rule deployment, optional patch path with verify-fix, VEX attestation publication.
pr-security-reviewerComprehensive pre-merge security agent — parallel SAST + SCA + secrets + container + IaC + license against the PR diff, dep-add-guard for new direct deps, optional gh pr review posting.
bulk-triage
Parallel CWSS scoring across many vulnerabilities — each analysed independently, single consolidated `.vulnetix/memory.yaml` write at the end, output grouped by P1–P4 priority tiers.
compliance-bundler
End-to-end compliance bundle agent — CycloneDX SBOM + SPDX licenses + SARIF findings + OpenVEX/CycloneDX VEX, optional cosign signing, optional Vulnetix upload, manifest.json with SHA-256 sums, Markdown index.
dep-upgrade-orchestrator
End-to-end dependency upgrade across all manifests — detect capabilities, scan for vulnerable deps, plan fixes ranked by patch-vs-major bump risk, apply per-manifest, run package-manager install, verify each fix, loop on conflicts via dep-resolve.
incident-responder
Full SOC playbook agent for an actively exploited CVE — parallel sightings + KEV + IOCs + ATT&CK + fixes + remediation pull, capability-aware detection-rule deployment, optional patch path with verify-fix, VEX attestation publication.
pr-security-reviewer
Comprehensive pre-merge security agent — parallel SAST + SCA + secrets + container + IaC + license against the PR diff, dep-add-guard for new direct deps, optional `gh pr review` posting.