AI-Assisted Network Vulnerability Assessment System
AIVAS is a free, offline-capable network vulnerability scanner for Linux. It combines Nmap service discovery, a local NIST NVD CVE database, active configuration probing, and optional AI-powered bilingual (English/Swahili) risk narration.
- CVE correlation against a local SQLite database synced from NIST NVD (200,000+ CVEs)
- CISA KEV flagging — marks CVEs actively exploited in the wild
- Level 1 active configuration probing: missing security headers, exposed endpoints, risky HTTP methods
- AI risk narration in English and Swahili via Groq or Ollama
- Interactive Textual TUI with slash commands and AI-routed free text input
- Scan history, HTML/PDF report export, and diff between scan sessions
- Fully offline after initial database sync
- Linux (Ubuntu 20.04+, Kali, Debian)
- Python 3.10 or later
- nmap (
sudo apt install nmap) - pip 23 or later
pip install aivasIf aivas is not found after install, add the local bin directory to your PATH:
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrcgit clone https://github.com/Baraka-Malila/aivas.git
cd aivas
python3 -m pip install --upgrade pip
python3 -m pip install -e ".[dev]"# Check your setup
aivas doctor
# Populate the CVE database (from local NVD JSON feeds)
aivas update-db --source /path/to/nvd-json-data-feeds/
# Or sync from the NVD API
aivas update-db
# Sync known exploited vulnerabilities
aivas update-kev
# Launch the interactive interface
aivasRun aivas with no arguments to open the interface. Type /help for a full command list.
| Command | Description |
|---|---|
/scan <target> |
Full CVE and config probe scan |
/quick <target> |
Fast service scan (level 1) |
/deep <target> [--udp] |
Full scan with UDP discovery |
/ask <query> |
Natural language scan routing (requires API key) |
/doctor |
Check dependencies and configuration |
/history list |
View past scan sessions |
/history show <id> |
Replay findings from a previous scan |
/kev |
Sync CISA Known Exploited Vulnerabilities |
/config set <key> <value> |
Save a configuration value |
/help |
List all commands |
/exit |
Quit |
Free text without a leading / is routed to the AI intent parser if an API key is configured. Without an API key, all core scanning features work without AI.
aivas scan 192.168.1.1
aivas scan 192.168.1.1 --level 2 --save --report report.html
aivas scan 192.168.1.1 --narrate --api-key YOUR_KEY
sudo aivas scan 192.168.1.1 --udp
aivas search apache --version 2.4.52
aivas history list
aivas config set api_key YOUR_GROQ_KEY| Level | What it does |
|---|---|
| 1 | Service version detection only |
| 2 | CVE correlation + NSE vulnerability scripts + config probing (default) |
| 3 | Level 2 + SSH-authenticated installed package scan |
Settings are stored in ~/.aivas/config.yml:
api_key: your-groq-api-key
provider: groq # groq or ollama
lang: both # en, sw, or both
default_level: 2Set any value:
aivas config set provider ollama
aivas config showSee CONTRIBUTING.md for development setup, coding standards, and how to submit changes.
MIT. See LICENSE.
AIVAS is intended for use on networks you own or have explicit authorisation to scan. Unauthorised scanning may be illegal in your jurisdiction.
Baraka Malila and Michael Chacha Megewa
Diploma in Computer Engineering, MUST (Mbeya University of Science and Technology), 2025/2026
Supervisor: Namsembwa Mzava