中文 | English
KunLun-M（昆仑镜） is an open-source static code security analysis system. It builds an AST graph from source code and performs taint analysis to detect vulnerabilities.
- 14 languages: PHP / JavaScript / TypeScript / Python / Java / Go / Ruby / Rust / C / C++ / C# / Kotlin / Lua / Solidity
- AST graph engine: Builds a full program graph (call graph, data flow, AST structure) for taint tracking
- CLI / Console / Web three modes
- Built-in AI Agent skill: One-click integration with Codex / Claude Code / Hermes etc.
# Install
git clone https://github.com/LoRexxar/Kunlun-M.git && cd Kunlun-M
pip install -r requirements.txt
cp Kunlun_M/settings.py.bak Kunlun_M/settings.py
# Init database
python kunlun.py init
# Scan
python kunlun.py scan -t /path/to/project
# Scan with specific language
python kunlun.py scan -t /path/to/project -lan php
# Export HTML report
python kunlun.py scan -t /path/to/project -f html -o report.html
# Web dashboard
python kunlun.py web -p 9999python kunlun.py <command> [args]
| Command | Description |
|---|---|
init |
Initialize / migrate database |
reset |
Reset database (clear scan data, TaintChain, legacy ResultFlow, workspace) |
scan -t <target> |
Scan target (file, directory, or archive) |
console |
Interactive console with graph REPL |
web [-p 9999] |
Web dashboard with API |
analyze |
AST graph secondary analysis |
export-project -p <project> |
Export project to portable archive |
import-project -f <archive> |
Import project from archive |
export-neo4j -p <project> |
Export AST graph to Neo4j |
| Parameter | Description |
|---|---|
-t/--target |
Target file/directory (required) |
-lan/--language |
Language (php/javascript/python/java/go/ruby/rust/c/cpp/csharp/kotlin/lua/solidity) |
-r/--rule |
Specific rules (comma-separated CVI IDs, e.g. 1000,1001) |
-f/--format |
Output format: csv (default) / json / md / html / xml |
-o/--output |
Output file path |
-tp/--tamper |
Apply tamper (e.g. wordpress) |
-b/--blackpath |
Exclude paths (e.g. vendor,node_modules) |
--without-vendor |
Skip SCA (vendor vulnerability) scan |
--no-cache |
Force rebuild graph (no cache) |
-d/--debug |
Debug mode |
| Command | Description |
|---|---|
export |
Export rules & tampers from database to files |
generate rule |
Generate rule template file |
generate tamper |
Generate tamper template file |
show rule [-k <key>] |
Show rules (filter by language/key) |
show tamper |
Show tampers |
search vendor <name> <version> |
Search vendor vulnerabilities |
plugin <name> |
Run plugin (entrance_finder / php_unserialize_chain_tools) |
Console mode provides an interactive REPL with graph traversal support:
python kunlun.py console
KunLun-M> scan
KunLun-M(scan)> set target /path/to/project
KunLun-M(scan)> run
KunLun-M> load 42
KunLun-M(result)> show vuls
KunLun-M(result)> graph # Enter graph traversal REPL
>>> g.function.main.ownout.count
14Inside the graph REPL, use g as the entry point for Joern-style graph queries:
>>> g.function # All function nodes
>>> g.file.index # File named 'index'
>>> g.identifier.session.dfg # Data flow from 'session'
>>> g.function.main.ownout # AST children of main
>>> g.identifier.input.uses # Functions using 'input'
>>> g.function.exec.shortest_path # Shortest path to 'exec'See docs/graph-traversal.md for the full API reference.
python kunlun.py web -p 9999
Web mode includes:
- Dashboard: Task management, project overview, scan results
- Graph Analysis: Interactive Cytoscape.js graph visualization (4 layouts)
- API: Token-authenticated REST API for automation
POST /api/task/create Create scan task
POST /api/task/create/start Create + auto-start scan
GET /api/task/<task_id>/status Task status
GET /api/task/list Task list
GET /api/task/<task_id>/result Scan results
GET /api/task/<task_id>/taintchain Taint chain data
GET /api/rule/list Rule list
GET /api/graph/query AST graph query
GET /api/graph/subgraph Subgraph extraction (for visualization)
GET /api/graph/chain_subgraph Taint chain subgraph
GET /api/graph/node_vulns Node-associated vulnerabilities
Configure API_TOKEN in Kunlun_M/settings.py for API authentication.
Export a complete project (database records + graph files) as a portable .tar.gz:
python kunlun.py export-project -p nodejs
python kunlun.py import-project -f kunlun-export-nodejs-*.tar.gz [--force]Export AST graphs to Neo4j for advanced Cypher queries:
python kunlun.py export-neo4j -p nodejs --clean
python kunlun.py export-neo4j -s 42 --neo4j-uri bolt://host:7687See docs/data-export.md for full documentation.
If you're using an AI Agent (Codex / Claude Code / Hermes etc.), send:
Download
https://github.com/LoRexxar/Kunlun-M.gitand load its skill (kunlun-m-general).
The agent will auto-detect skills/kunlun-m-general/ and follow the docs to initialize and scan.
See docs/skill_kunlunm_general.md for scripted workflows.
| Language | Semantic Analysis | Graph Engine |
|---|---|---|
| PHP | ✅ | ✅ |
| JavaScript | ✅ | ✅ |
| TypeScript | ✅ | ✅ |
| Python | ✅ | ✅ |
| Java | ✅ | ✅ |
| Go | ✅ | ✅ |
| Ruby | ✅ | ✅ |
| Rust | ✅ | ✅ |
| C | ✅ | ✅ |
| C++ | ✅ | ✅ |
| C# | ✅ | ✅ |
| Kotlin | ✅ | ✅ |
| Lua | ✅ | ✅ |
| Solidity | Basic | — |
Automatically discovers PHP deserialization chains and generates PoC files:
python kunlun.py plugin php_unserialize_chain_tools -t /path/to/php/projectQuickly finds potential PHP entry pages in large codebases:
python kunlun.py plugin entrance_finder -t /path/to/php/project -l 3Rules follow the convention rules/{language}/CVI_{id}.py. See rules/rule.template for a template.
core/
├── __init__.py CLI entry, subcommand dispatch
├── scanner.py Graph-based scan engine (build graph → taint analysis)
├── graph/
│ ├── graph_pipeline.py AST → igraph graph builder
│ ├── graph_query_builder.py 6 query methods (overview/file/function/trace/search/subgraph)
│ ├── graph_io.py Graph persistence (GraphMLZ)
│ ├── node_edge_schema.py 12 node types, 9 edge types
│ └── workspace.py Scan workspace management
├── import_export.py Project archive export/import
├── neo4j_export.py igraph → Neo4j export
├── console.py Interactive console + graph REPL
└── engine.py Thin re-export layer
web/
├── index/ Models, dashboard pages
├── api/ REST API (session + token auth)
└── dashboard/ Web UI (templates + controllers)
- docs/README.md — Documentation index
- docs/cli.md — CLI detailed reference
- docs/architecture.md — Architecture overview
- docs/ast-graph-structure.md — AST graph schema, branch constraints & guard system
- docs/data-export.md — Export/import & Neo4j
- docs/graph-traversal.md — Graph traversal REPL
- docs/changelog.md — Changelog
KunLun-M is part of the 404Team StarLink Project.
Core Developer:
Important Contributors:
Contributors:
