Which models work with Vulnotes?

Every model OpenAI API compatible: Vulnotes AI, OpenAI, Anthropic, Google, Mistral, Groq, Azure, Together, DeepSeek, OpenRouter, Ollama... Vulnotes AI is managed and included in every plan. See https://vulnotes.com/pricing for what every plan includes.

What counts toward the 1M tokens?

Every plan includes 1M AI tokens per user per month for Vulnotes AI, covering generation, improvement, translation and vision. When you bring your own provider key, those requests go through your provider account instead. Full details at https://vulnotes.com/pricing.

AI Pentest Reporting.Screenshot In, Finding Out.

Generate vulnerability writeups, improve report sections, translate content and turn screenshots into structured findings.

14-day free trialSelf-hosting includedCancel anytime

Automatic Anonymization, Before Anything Leaves

Before any data reaches an AI provider, sensitive values are replaced with placeholders and restored in the response. The provider doesn't see your real client data.

Prefer zero egress? Run a fully local model on a self-hosted instance, or disable AI entirely.

Replaced with placeholders, restored in the response

Company names
IP addresses
Domain names and URLs
Email addresses
Person names

A built-in image redaction editor blacks out secrets before anything is sent.

Up to 5 screenshots

pasted in one request

AI vision

your chosen provider

Structured finding

follows your vulnerability template

Turn Screenshots into Findings

Paste the images of your exploit and get back a generated finding that matches your vulnerability, ready to refine in the report editor.

Paste multiple screenshots in a single request
Finding fields follow your vulnerability template
Redact secrets first with the built-in screenshot editor

Improve options

RewriteShortenExpandFix grammarMake more professional

Generation tones

ProfessionalTechnicalExecutiveRemediation-focusedCustom

Generate Findings

Start from a quick description and generate the full vulnerability: description, impact, remediation and every field as you defined it in your template. Then improve any section in place.

Improve options: Rewrite, Shorten, Expand, Fix grammar, Make more professional
Generation tones: Professional, Technical, Executive, Remediation-focused, Custom
Per-feature toggles keep generation only where you want it

Preserved

Formatting
Lists
Code blocks

Left unchanged

Technical terms
Code snippets
URLs

Translate In Seconds

Translate your vulnerability templates to any language within seconds.

Technical terms, code snippets and URLs are left unchanged
72 languages available

Bring Your Own Model

Choose between multiple provider types, from managed to fully local. Plug in your own key or use the built-in Vulnotes AI.

Vulnotes AIOpenAIAnthropicGoogleMistralGroqAzureTogetherDeepSeekOpenRouterOllamaCustom OpenAI-compatible

Vulnotes AI is managed and included in every plan: 1M tokens per user per month. See what every plan includes

You can provide your own fully local LLM. Pair it with a self-hosted instance and your prompts stay on your network.

AI on Your Terms

Scope it, steer it, or switch it off.

One-click full AI disable

Turn AI off across the whole instance in one click.

Per-feature toggles

Enable or disable AI separately for any feature of your instance.

Write Reports from Any MCP Client

Connect your instance to Claude or any MCP client with one command, then write and export pentest reports without leaving the chat.

40+ MCP tools across reports, findings, templates, vulnerability library, notes...
Strict template validation rejects malformed AI-created findings

bash

claude mcp add --transport http vulnotes https://your-instance.vulnotes.app/mcp \
--header "Authorization: Bearer vuln_sk_your_api_key_here"

Everything in the UI is scriptable

Don't want to use the MCP for redundant workflows? Automate it via our REST API with 160+ endpoints!

Browse the API reference

Frequently Asked Questions

Yes. One click disables AI across the instance, and per-feature toggles let you switch it off only for vulnerabilities, findings, report content or custom variables. The same controls apply in the cloud and on a self-hosted instance. Learn about self-hosting

When you use an external provider, company names, IP addresses, domain names and URLs, email addresses and person names are replaced with placeholders before the request and restored in the response. With a local Ollama model, nothing leaves your network. See how anonymization works

12 provider types: Vulnotes AI, OpenAI, Anthropic, Google, Mistral, Groq, Azure, Together, DeepSeek, OpenRouter, Ollama and any custom OpenAI-compatible endpoint. Vulnotes AI is managed and included in every plan. See what every plan includes

Every plan includes 1M AI tokens per user per month for Vulnotes AI, covering generation, improvement, translation and vision. 1M token is more than enough for 99% of teams. When you bring your own provider key, those requests go through your provider account instead.

Explore More

Report Editor & Exports

Rich text findings, CVSS scoring and five export formats.

Template Builder

Design branded report layouts in your browser, no Word hacking.

Self-Hosted or Cloud

Run models locally and keep pentest data on your network.

Start today

Ready to Write
Better Reports?

Set up in minutes. Write, review and deliver your next pentest report in Vulnotes.