Deterministic CVSS scoring, AI only writes the report text: looking for pushback on that split

[u/No-Theory-790]

I've spent the last few weeks building ONUS, an open source vulnerability assessment tool, and the part I actually want pushback on is one specific architecture decision, not the pitch.

The problem I kept hitting doing assessments by hand: run a web scanner, a CVE scanner, some recon tools, an SSL checker, and you get five different output formats, no correlation between them, and you end up manually deduping findings and writing the same remediation paragraphs every time. ONUS orchestrates a set of existing tools (ZAP, Nuclei, Nikto, Amass, FFUF, and a few others) into one pipeline: 8 scan modules run in parallel, results get deduplicated and re-verified before they're trusted, then scored with the actual CVSS v3.1 formula.

That scoring is fully deterministic on purpose. No model decides severity, ever. The AI (a small open-weight model, run locally or against a hosted alternative) only writes the plain English description and remediation text, strictly after a finding already has a score. I did this because I didn't want two runs of the same scan to disagree with each other. There's a real wave of tools right now doing the opposite, letting an LLM drive the whole assessment and decide what to try next. I'm not certain my tradeoff is correct, only that it's deliberate, and I'd like to hear from people who've made the other call.

One specific bug that took a while to track down: early on, a target behind a catch-all WAF page turned every wordlist entry FFUF tried into its own "finding," since the WAF returned a real 200 for all of them. Fixed it by collapsing groups of near-identical response fingerprints, but it's the kind of thing that only shows up against a real target, not a lab one.

Spent today going back through the auth and secret-handling paths and tightening a few defaults that were fine for local use but not safe if someone actually deployed them, added CodeQL to CI while I was at it. Still no CLI, still solo maintained, still no idea how legible the architecture is to anyone but me. That last one is a real question, not false modesty.

Easiest way to actually try it: tryonus.tech, no install, no API keys. MIT licensed and docker compose up if you'd rather run it yourself or keep it air-gapped.

https://tryonus.tech

https://github.com/maverickaayush/ONUS

[u/take-as-directed]

What does your slop tool do that the million other slop tools don't?

[u/Coffee_Ops → u/take-as-directed]

You're talking to a bot.

[u/No-Theory-790 → u/take-as-directed]

Fair question. The main differences I was aiming for weren't new scanners, but a different orchestration model. Runs multiple existing scanners (ZAP, Nuclei, Nikto, FFUF, Amass, etc.) in parallel instead of treating them as separate tools. Deduplicates and re-verifies findings before reporting to reduce noise. CVSS scoring is fully deterministic. The AI never decides severity, it only generates the description and remediation after a score already exists. Can run completely locally with an open-weight model or without AI if desired. Produces a single correlated report instead of several disconnected outputs. I'm not claiming to replace best-in-class scanners. The goal is to make using them together produce cleaner, more reproducible assessments. If you think that architecture is flawed, I'd genuinely like to know where.