selvo

Know what's actually dangerous on your Linux servers.

selvo scans your installed packages, checks every CVE against 8 data sources, filters out what your distro already patched, and ranks the rest by blast radius and exploit probability. Not just a list --- a prioritized action plan.

Live at selvo.dev | Public Report | GitHub Action

Quick Start

Scan your server (60 seconds)

curl -s https://selvo.dev/install.sh | SELVO_API_KEY=sk_xxx bash

Collects your real installed packages, sends to the API for analysis, sets up daily monitoring via cron. Supports dpkg, rpm, pacman, apk.

Get a free API key at selvo.dev.

GitHub Actions

- uses: Cope-Labs/selvo-action@v1
  with:
    api-key: ${{ secrets.SELVO_API_KEY }}

Auto-detects runner packages. Posts results as a PR comment. Fails on CISA KEV or weaponized exploits.

curl

# Scan your actual packages
dpkg-query -W -f='${db:Status-Abbrev}  ${Package}  ${Version}\n' > packages.txt

curl -X POST https://selvo.dev/api/v1/scan/packages \
  -H "X-API-Key: $SELVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"packages\": \"$(cat packages.txt)\", \"ecosystem\": \"debian\"}"

Container image scan

curl -X POST https://selvo.dev/api/v1/scan/image \
  -H "X-API-Key: $SELVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "nginx:1.24"}'

Pipe existing scanner output

# Already running Grype or Trivy? Send the JSON for prioritized results:
curl -X POST https://selvo.dev/api/v1/scan \
  -H "X-API-Key: $SELVO_API_KEY" \
  -d "{\"grype\": \"$(cat grype-results.json)\"}"

What Makes It Different

Distro-aware CVE filtering. If Debian backported a fix into zlib 1.2.11, we don't flag it. We cross-reference the Debian Security Tracker to remove CVEs your distro already patched. Other scanners miss this and massively over-report.

Blast radius scoring. A CVE in a library that 200 packages depend on ranks higher than one in a leaf package. We build real dependency graphs from Debian Packages.gz, Alpine APKINDEX, and Arch repo DBs.

Exploit intelligence. CISA KEV status, public exploit availability, EPSS exploitation probability --- not just CVSS severity.

Your actual packages. We scan what's really installed on your system, not a generic reference list. The dashboard shows "Your system" vs "Reference scan" so you know exactly what you're looking at.

Scoring (0--100)

Packages with no security signal are capped at 20. Runtime-loaded packages with CVEs get a 1.5x multiplier.

API Endpoints

Base URL: https://selvo.dev/api/v1

Scanning

Data

Exports

Policy and Fix

Webhooks

All endpoints require X-API-Key header. Get a free key at selvo.dev.

Policy-as-Code

Define security gates in YAML and evaluate via API or dashboard:

version: 1
block:
  on_kev: true
  on_weaponized: true
  min_cvss: 9.0
  min_score: 80
warn:
  on_poc: true
  min_cvss: 7.0
sla:
  critical: 7
  high: 30
  medium: 90
  low: 365
allow:
  cves:
    - id: CVE-2023-12345
      reason: "Not reachable in our deployment"
      expires: 2025-12-31

curl -X POST https://selvo.dev/api/v1/policy/check \
  -H "X-API-Key: $KEY" \
  -d '{"ecosystem":"debian","policy":{"version":1,"block":{"on_kev":true,"min_cvss":9.0}}}'

Or use the dashboard at selvo.dev/dash/policy.

Webhook / Slack Alerts

Get notified when scans complete:

curl -X POST https://selvo.dev/api/v1/orgs/myorg/webhooks \
  -H "X-API-Key: $KEY" \
  -d '{"url":"https://hooks.slack.com/services/T.../B.../xxx","kind":"slack"}'

Fires on every scan completion with package count, CVE count, and KEV status.

Data Sources

Supported Ecosystems

Native OSV coverage (11): Debian, Ubuntu, Fedora, Alpine, Rocky Linux, AlmaLinux, SUSE, openSUSE, Wolfi, Chainguard, Mageia.

Via Debian namespace (5): Arch, NixOS, Homebrew, Chocolatey, Winget.

Plus: CycloneDX/SPDX SBOM, Grype/Trivy JSON, 11 lockfile formats (requirements.txt, package-lock.json, Cargo.lock, go.sum, Gemfile.lock, composer.json, pom.xml, and more).

CLI (Self-Hosted)

The full CLI runs locally with no API dependency:

pip install -e ".[dev,api]"

selvo analyze --ecosystem debian --limit 50
selvo scan requirements.txt --output sarif --file results.sarif
selvo policy check
selvo fix --dry-run --top 5
selvo fleet scan hosts.txt
sudo selvo runtime          # scan loaded .so files in live processes
selvo compliance --framework fedramp
selvo sla
selvo trend
selvo diff

Self-Hosting (Server)

Run the same SaaS stack that powers selvo.dev on your own infrastructure. Five-minute install via Docker Compose:

git clone https://github.com/Cope-Labs/selvo.git
cd selvo/deploy/selfhost
cp .env.example .env             # set SELVO_API_SECRET, NVD_API_KEY, etc.
cp Caddyfile.example Caddyfile   # set your domain
docker compose up -d

Caddy handles automatic Let's Encrypt TLS. The selvo image is multi-arch (amd64 + arm64) and is rebuilt on every push to main. See deploy/selfhost/README.md for sizing, backups, Cloudflare-in-front guidance, and what isn't included.

The ELv2 license lets you self-host for your own organization, modify the source, and redistribute. It does not let you offer selvo as a managed service to third parties — for that contact licensing@cope-labs.dev.

MCP Server (AI Assistant Integration)

16 tools for Claude Desktop, Cursor, and other MCP-compatible agents:

{
  "mcpServers": {
    "selvo": { "command": "selvo-mcp" }
  }
}

Tools: analyze_packages, check_local_risk, describe_package, list_cves, patch_plan, fleet_scan, get_sla_report, and more.

Pricing

Self-serve at selvo.dev. No credit card required for free tier.

License

Elastic License 2.0 (ELv2) --- free to use, modify, and self-host. You may not offer selvo as a managed service to third parties.

Built by Cope Labs LLC | Privacy | Terms | Status