Cerno

What cerno does

cerno combines an interactive terminal interface with an MCP server for organizing and verifying vulnerability findings. It imports Nessus .nessus exports and nuclei JSON or JSONL results into a local SQLite database, allowing findings from both scanners to be reviewed together.

The workflow is designed around triage: inspect findings by severity, host, exploitability, and affected ports; examine finding details and CVEs; compare findings across hosts; and record review progress. The database preserves this state across restarts and supports comparison of host risk across scans.

How it works

A typical engagement begins by importing one or more scan files. cerno stores the normalized results in ~/.cerno/cerno.db, where they can be opened in the review TUI or accessed through MCP. Multi-scan reviews can include Nessus and nuclei data in the same workflow.

From a finding, the operator can launch commands against its exact hosts and ports. Supported workflows include nmap NSE scripts, NetExec, nuclei, Metasploit, and custom commands. Executions and resulting artifacts are logged, and verification information can be recorded against the finding.

The MCP interface exposes the same database and tooling for programmatic use. An MCP client can query findings and generate commands, making it possible to drive an engagement without navigating every operation manually in the TUI.

Setup and configuration

cerno requires Python 3.11 or newer and is intended primarily for Linux or macOS. Linux is recommended; Windows support is best-effort because parts of the MCP job runner use POSIX process groups.

Install the package with pipx:

pipx install git+https://github.com/ridgebackinfosec/cerno.git

Alternatively, use pip with the same Git repository. After installation, import a scan and open the review interface:

cerno import nessus scan.nessus
cerno import nuclei nuclei.json
cerno review

The configuration file is created at ~/.cerno/config.yaml. Configuration commands can show, read, change, or reset settings. Available settings include terminal color scheme and optional proxychains4 routing. When enabled, configured tools can be routed through a SOCKS5 proxy, which is useful for a pivoted assessment path.

Optional external programs are needed only for the workflows that use them: nmap, nxc or NetExec, msfconsole, and Claude. Linux clipboard operations can use xclip, xsel, or wl-copy.

Tools and capabilities

• Import Nessus and nuclei scan results into SQLite.
• Browse, filter, and review findings in a keyboard-driven TUI.
• Track reversible review states, sessions, executions, and artifacts.
• Extract CVEs and search Metasploit modules from finding context.
• Compare findings across hosts, including identical combinations and supersets.
• Launch nmap, NetExec, nuclei, Metasploit, or custom commands for affected hosts and ports.
• Expose finding queries and command generation through MCP.
• Use proxychains4 routing as a configurable option.

Limitations and notes

The MCP functionality is identified as beta. External security tools are optional dependencies, so their workflows require the corresponding executables to be installed separately. Windows is untested and may encounter limitations in MCP job execution. The included demo data uses documentation-only IP ranges and .example hostnames.