Unfragile

No product named VulnHawk appears among the candidates, so I cannot confirm it exists or describe its scan. The closest matches for a security scan are StackHawk, which runs DAST scans through HawkScan and offers an MCP server and API 414, and Trivy, an open source scanner for vulnerabilities and misconfigurations 6. If you meant VulnHawk specifically, please share its official site or docs.

1
StackHawk HawkScanstackhawk.comverified and signed
Configures, runs and interprets HawkScan DAST scans inside a coding agent, generating stackhawk.yml configs and running scans via CLI or Docker 14.
Website Docs Pricing Get started
official:MCP server · com.stackhawk/stackhawk+1 community tools built for it
for agents: stackhawk-hawkscan · stackhawk-api
2
Trivytrivy.devwebsite read, tools not yet checked
Finds vulnerabilities (CVE) and misconfigurations (IaC) across code repositories, container images and Kubernetes clusters 6.
Website Docs
+4 community tools built for it
3
Semgrep App Security Platformsemgrep.devverified and signed
Scans source code with SAST, SCA and secrets detection to surface actionable security issues 212.
Website Docs Pricing Get started
+4 community tools built for it
for agents: semgrep · semgrep · code-security
4
Vulsvuls.iowebsite read, tools not yet checked
Agentless vulnerability scanner for Linux and FreeBSD that checks installed packages against NVD, JVN, OVAL and vendor advisories 3.
Website Docs

Sources

2Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
3Vuls · Agentless Vulnerability Scanner for Linux/FreeBSDvuls.io · read 2026-10-29
4AI Coding Agent Security Platform | StackHawk, Inc.stackhawk.com · read 2026-10-29
6Trivytrivy.dev · read 2026-10-29
12semgrep: declares "semgrep" (the record we read and signed)unfragile.ai · read 2026-10-24
14stackhawk-hawkscan: declares "stackhawk-hawkscan" (the record we read and signed)unfragile.ai · read 2026-10-24

For agents: the 10 actions behind this answer

scan_memory_entry · www-project-agent-memory-guard found in code, not yet checked
Scan a single memory entry for security threats.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
· Vuls website read, tools not yet checked
Agentless Vulnerability Scanner for Linux/FreeBSD
stackhawk-hawkscan · stackhawk-hawkscan verified and signed
Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.
· Nmap: the Network Mapper website read, tools not yet checked
Nmap Free Security Scanner, Port Scanner, & Network Exploration Tool. Download open source software for Linux, Windows, UNIX, FreeBSD, etc.
· Trivy website read, tools not yet checked
Trivy is the most popular open source security scanner for Vulnerability &, IaC, SBOM discovery, cloud scanning and Kubernetes security
SonarSource/sonarqube-scan-action · Official SonarQube Scan verified and signed
Scan your code with SonarQube Server and Cloud to detect issues in 30+ languages. (Formerly SonarQube and SonarCloud)
· Joern website read, tools not yet checked
zizmorcore/zizmor-action · zizmor-action verified and signed
Run zizmor from GitHub Actions 🌈
scan · safety verified and signed

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.