CVE matching, MITRE ATT&CK technique annotations, and composite risk scoring — with a finding-suppression workflow to cut false positives from your report. Client-ready PDF export included.
Version-based CVE matching is just the start. Every finding is scored by composite risk and ranked, so the highest-impact issues surface first. Findings are emitted unverified — you adjudicate what stays, not the scanner.
A finding-suppression workflow lets you mark items accepted-risk or false-positive; suppressed findings drop out of the report and the risk rollup. Every decision is recorded per scan.
Auto-generated CPEs from detected services matched against the NVD feed — offline, no API calls. Know which CVEs affect each host before writing a single line of your report.
Every finding is annotated with the ATT&CK techniques it relates to, with kill-chain context. Compliance teams love it. Clients understand it. Takes zero extra effort on your part.
Five specialized agents run concurrently — Auth, Crypto, Config, Service, and Exposure. Each produces structured findings for its category, then feeds the risk engine.
Composite scoring: severity × exploitability × impact × exposure. Prioritized, sortable output — the highest-impact findings rise to the top, and suppressed findings drop out of the rollup.
Export findings as HTML, JSON, or Markdown — print the HTML to PDF for a client-ready document. Risk-ranked, with a summary overview and technical findings in one file.
Same OpenAI / Claude / Ollama providers you use in CE — but Pro injects CVE matches, MITRE techniques, and risk scores into every prompt. Vastly better output.
Unlimited scan history in SQLite. CVE-level delta detection — new vulnerabilities since last scan, not just host diffs. Risk trend analysis (improving / degrading / stable).
Configurable profiles (strict / moderate / minimal), additional patterns for AWS keys, DB connection strings, and JWTs. Full redaction audit log for compliance.
Four additional tools for AI assistant integration: get_vulnerabilities, risk_summary, scan_compare, save_finding.
Agents run via Promise.allSettled — if one category has no relevant services, it's skipped. Results feed the risk engine.
Start the MCP server with nsauditor-ai-mcp — works with Claude Desktop, Cursor, and any MCP-compatible AI assistant.
# @nsasoft/nsauditor-ai-ee is a private (restricted) package. # Use the npm read-token delivered with your license email. npm config set //registry.npmjs.org/:_authToken npm_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # Or, project-scoped, in an .npmrc file echo "//registry.npmjs.org/:_authToken=npm_xxxx..." >> ~/.npmrc
# One line — installs both the CE platform and the Pro package npm install -g nsauditor-ai @nsasoft/nsauditor-ai-ee
# CE 0.2.24+ verifies the JWT signature before persisting # and stores the key in macOS Keychain (or ~/.nsauditor/.env mode 0600 elsewhere). nsauditor-ai license install pro_eyJhbGciOiJFUzI1NiIs... ✓ Pro license installed Stored at: macOS Keychain (service=nsauditor-ai) Org: you@example.com Expires: 2027-04-29 # Verify nsauditor-ai license --status ✓ Pro license active
nsauditor-ai scan --host 192.168.1.0/24 --plugins all # View your AI report in browser open out/192.168.1.0_*/scan_response_ai.html # macOS xdg-open out/192.168.1.0_*/scan_response_ai.html # Linux # Each scan writes HTML, JSON, and Markdown reports — print the HTML to PDF for clients nsauditor-ai scan --host 10.0.0.0/24 --plugins all open out/10.0.0.0_*/scan_response_ai.html # print → PDF
Subscribe directly to unlock CVE matching, MITRE ATT&CK annotations, risk scoring, parallel analysis agents, and PDF reports. Cancel anytime — reverts to Community Edition with no data lost.