project 03 / vulnerability research
Ayano.
A CVE-analysis CLI that gathers the context I need before a vulnerability ID becomes useful research.
- Status
- Research tool
- Interface
- Command line
- Sources
- NVD / GitHub
- Built with
- Python
01 / what it is
From an identifier to a research trail.
Ayano accepts a CVE and collects the pieces that normally end up spread across browser tabs: vulnerability details, severity and affected-product context, public proof-of-concept searches, and useful research references.
It is described as AI-powered because analysis and summarization can be part of the workflow. The foundation, however, is practical aggregation: retrieve good source material before trying to explain it.
02 / why I built it
A CVE number is the beginning, not the answer.
A database entry can tell me that a vulnerability exists without making the bug easy to understand. I still need to find the vulnerable component, the conditions that make exploitation possible, patches, public research, and any code that demonstrates the behavior.
Ayano is meant to remove the repetitive searching so I can spend more time understanding the vulnerability.
03 / how it works
Collect first. Explain second.
The useful output should keep source and inference separate. A published severity score, a repository claiming to be a PoC, and an AI-generated explanation do not carry the same confidence; the interface should not make them look identical.
04 / current direction
Make provenance visible.
The strongest version of Ayano is not one that sounds certain. It is one that makes it quick to trace a statement back to NVD, a vendor advisory, a commit, or public research—and labels generated interpretation as interpretation.
Future work is less about adding more text and more about ranking evidence, detecting weak or suspicious PoC repositories, and turning the result into a reproducible research checklist.