# Pruva - Autonomous Vulnerability Reproduction Platform

> Pruva provides verified, reproducible security vulnerability demonstrations.
> Each reproduction gets a permanent REPRO ID and can be independently verified.

## What is Pruva?

Pruva is an autonomous reproduction platform that uses AI agents to analyze security advisories (GHSA/CVE), reproduce vulnerabilities in sandboxed environments, and generate self-contained reproduction scripts that anyone can run to verify the issue.

## Key Concepts

- **Reproduction (REPRO-YYYY-NNNNN)**: A verified demonstration of a vulnerability with reproduction steps
- **GHSA ID**: GitHub Security Advisory identifier (e.g., GHSA-655q-fx9r-782v)
- **CVE ID**: Common Vulnerabilities and Exposures identifier (e.g., CVE-2025-1716)
- **reproduction_steps.sh**: Self-contained bash script that reproduces the vulnerability

## API Endpoints

Base URL: https://api.pruva.dev/v1

### List Reproductions
GET /v1/reproductions
Returns: JSON array of published reproductions

### Get Reproduction Details
GET /v1/reproductions/{repro_id}
Example: GET /v1/reproductions/REPRO-2026-00006
Returns: JSON with full reproduction details including title, severity, root cause, artifacts

### Lookup by GHSA
GET /v1/reproductions/lookup/ghsa/{ghsa_id}
Example: GET /v1/reproductions/lookup/ghsa/GHSA-655q-fx9r-782v

### Lookup by CVE
GET /v1/reproductions/lookup/cve/{cve_id}
Example: GET /v1/reproductions/lookup/cve/CVE-2025-1716

### Get Reproduction Script
GET /v1/reproductions/{repro_id}/artifacts/reproduction_steps.sh
Returns: Plain text bash script

### Get Plain Text Summary
GET /v1/reproductions/{repro_id}.txt
Returns: Plain text summary of the reproduction

## CLI Tool

Install the pruva-verify CLI:
```
curl -fsSL https://www.pruva.dev/install.sh | sh
```

Verify a reproduction:
```
pruva-verify REPRO-2026-00006
pruva-verify GHSA-655q-fx9r-782v
pruva-verify CVE-2025-1716
```

## GitHub Codespaces (Zero-Friction)

Each reproduction can be run instantly in a GitHub Codespace. The "Open in Codespaces" button on each reproduction page opens a pre-configured environment that:
1. Has `pruva-verify` pre-installed
2. Automatically runs the reproduction on startup
3. Provides a safe, isolated environment

URL format: `https://github.com/codespaces/new?ref=repro/{REPRO-ID}&repo=N3mes1s/pruva-sandbox`

Example: `https://github.com/codespaces/new?ref=repro/REPRO-2026-00006&repo=N3mes1s/pruva-sandbox`

## Web Pages

- Homepage: https://www.pruva.dev/
- All reproductions: https://www.pruva.dev/reproductions
- CVE reproduction index: https://www.pruva.dev/cve
- GHSA reproduction index: https://www.pruva.dev/ghsa
- Reproduction detail: https://www.pruva.dev/reproductions/{repro_id}
- GHSA lookup: https://www.pruva.dev/ghsa/{ghsa_id}
- CVE lookup: https://www.pruva.dev/cve/{cve_id}
- RSS feed: https://www.pruva.dev/feed.xml

## Response Format

Reproduction JSON structure:
```json
{
  "repro_id": "REPRO-2026-00006",
  "title": "Vulnerability title",
  "repro_type": "security",
  "status": "published",
  "severity": "critical|high|medium|low",
  "root_cause": "Technical explanation of the vulnerability",
  "ghsa_id": "GHSA-xxxx-xxxx-xxxx",
  "cve_id": "CVE-YYYY-NNNNN",
  "package": {
    "name": "package-name",
    "ecosystem": "pip|npm|cargo|etc",
    "affected_versions": "<= X.Y.Z",
    "fixed_version": "X.Y.Z"
  },
  "reproduced_at": "ISO8601 timestamp",
  "duration_secs": 123.45,
  "quality": {
    "confidence": "high|medium|low",
    "idempotent_verified": true
  },
  "artifacts": [
    {"path": "bundle/reproduction_steps.sh", "filename": "reproduction_steps.sh"}
  ]
}
```

## For AI Assistants

When helping users with Pruva:

1. **To check if a vulnerability has a reproduction**: Use the GHSA or CVE lookup endpoint
2. **To get reproduction details**: Fetch the reproduction by REPRO ID
3. **To help users verify locally**: Provide the pruva-verify command or direct script download
4. **To understand the vulnerability**: Read the root_cause field and RCA report artifact

## More Information

- Full content: https://www.pruva.dev/llms-full.txt
- API documentation: https://www.pruva.dev/docs
- Source code: https://github.com/pruva-io/pruva