Kunlun-M

中文 | English

KunLun-M

KunLun-M（昆仑镜） is an open-source static code security analysis system. It builds an AST graph from source code and performs taint analysis to detect vulnerabilities.

• 14 languages: PHP / JavaScript / TypeScript / Python / Java / Go / Ruby / Rust / C / C++ / C# / Kotlin / Lua / Solidity
• AST graph engine: Builds a full program graph (call graph, data flow, AST structure) for taint tracking
• CLI / Console / Web three modes
• Built-in AI Agent skill: One-click integration with Codex / Claude Code / Hermes etc.

Quick Start

# Install
git clone https://github.com/LoRexxar/Kunlun-M.git && cd Kunlun-M
pip install -r requirements.txt
cp Kunlun_M/settings.py.bak Kunlun_M/settings.py

# Init database
python kunlun.py init

# Scan
python kunlun.py scan -t /path/to/project

# Scan with specific language
python kunlun.py scan -t /path/to/project -lan php

# Export HTML report
python kunlun.py scan -t /path/to/project -f html -o report.html

# Web dashboard
python kunlun.py web -p 9999

CLI Commands

python kunlun.py <command> [args]

Core Commands

Command Description init Initialize / migrate database reset Reset database (clear scan data, TaintChain, legacy ResultFlow, workspace) scan -t <target> Scan target (file, directory, or archive) console Interactive console with graph REPL web [-p 9999] Web dashboard with API analyze AST graph secondary analysis export-project -p <project> Export project to portable archive import-project -f <archive> Import project from archive export-neo4j -p <project> Export AST graph to Neo4j

Scan Parameters

Parameter Description -t/--target Target file/directory (required) -lan/--language Language (php/javascript/python/java/go/ruby/rust/c/cpp/csharp/kotlin/lua/solidity) -r/--rule Specific rules (comma-separated CVI IDs, e.g. 1000,1001) -f/--format Output format: csv (default) / json / md / html / xml -o/--output Output file path -tp/--tamper Apply tamper (e.g. wordpress) -b/--blackpath Exclude paths (e.g. vendor,node_modules) --without-vendor Skip SCA (vendor vulnerability) scan --no-cache Force rebuild graph (no cache) -d/--debug Debug mode

Other Commands

Command Description export Export rules & tampers from database to files generate rule Generate rule template file generate tamper Generate tamper template file show rule [-k <key>] Show rules (filter by language/key) show tamper Show tampers search vendor <name> <version> Search vendor vulnerabilities plugin <name> Run plugin (entrance_finder / php_unserialize_chain_tools)

Console Mode

Console mode provides an interactive REPL with graph traversal support:

python kunlun.py console

KunLun-M> scan
KunLun-M(scan)> set target /path/to/project
KunLun-M(scan)> run

KunLun-M> load 42
KunLun-M(result)> show vuls
KunLun-M(result)> graph           # Enter graph traversal REPL
>>> g.function.main.ownout.count
14

Graph Traversal REPL

Inside the graph REPL, use g as the entry point for Joern-style graph queries:

>>> g.function                          # All function nodes
>>> g.file.index                        # File named 'index'
>>> g.identifier.session.dfg            # Data flow from 'session'
>>> g.function.main.ownout              # AST children of main
>>> g.identifier.input.uses             # Functions using 'input'
>>> g.function.exec.shortest_path      # Shortest path to 'exec'

See docs/graph-traversal.md for the full API reference.

Web Dashboard

python kunlun.py web -p 9999

Web mode includes:

• Dashboard: Task management, project overview, scan results
• Graph Analysis: Interactive Cytoscape.js graph visualization (4 layouts)
• API: Token-authenticated REST API for automation

Main API Endpoints

…

Configure API_TOKEN in Kunlun_M/settings.py for API authentication.

Data Export & Import

Project Archive

Export a complete project (database records + graph files) as a portable .tar.gz:

python kunlun.py export-project -p nodejs
python kunlun.py import-project -f kunlun-export-nodejs-*.tar.gz [--force]

Neo4j Graph Export

Export AST graphs to Neo4j for advanced Cypher queries:

python kunlun.py export-neo4j -p nodejs --clean
python kunlun.py export-neo4j -s 42 --neo4j-uri bolt://host:7687

See docs/data-export.md for full documentation.

AI Agent Integration

If you're using an AI Agent (Codex / Claude Code / Hermes etc.), send:

Download https://github.com/LoRexxar/Kunlun-M.git and load its skill (kunlun-m-general).

The agent will auto-detect skills/kunlun-m-general/ and follow the docs to initialize and scan.

See docs/skill_kunlunm_general.md for scripted workflows.

Supported Languages

Language Semantic Analysis Graph Engine PHP ✅ ✅ JavaScript ✅ ✅ TypeScript ✅ ✅ Python ✅ ✅ Java ✅ ✅ Go ✅ ✅ Ruby ✅ ✅ Rust ✅ ✅ C ✅ ✅ C++ ✅ ✅ C# ✅ ✅ Kotlin ✅ ✅ Lua ✅ ✅ Solidity Basic —

Plugins

PHP Deserialization Chain Finder

Automatically discovers PHP deserialization chains and generates PoC files:

python kunlun.py plugin php_unserialize_chain_tools -t /path/to/php/project

Entrance Finder

Quickly finds potential PHP entry pages in large codebases:

python kunlun.py plugin entrance_finder -t /path/to/php/project -l 3

Development

Rule Development

Rules follow the convention rules/{language}/CVI_{id}.py. See rules/rule.template for a template.

Architecture

…

Documentation

• docs/README.md — Documentation index
• docs/cli.md — CLI detailed reference
• docs/architecture.md — Architecture overview
• docs/ast-graph-structure.md — AST graph schema, branch constraints & guard system
• docs/data-export.md — Export/import & Neo4j
• docs/graph-traversal.md — Graph traversal REPL
• docs/changelog.md — Changelog

Changelog

docs/changelog.md

Stargazers

404StarLink Project

KunLun-M is part of the 404Team StarLink Project.

Contributors

Core Developer:

• LoRexxar

Important Contributors:

• Vidar-Team LuckC4t
• Dubhe Sissel

Contributors:

• Dubhe Sndav, #jax777, lavon321, Raul1718, akkuman

License

MIT License