Kritt-ai/open-kritt

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

What it solves

Finding security vulnerabilities in large codebases is difficult for AI models when they are asked to analyze everything at once. open·kritt solves this by breaking down the research process into small, focused tasks that are executed by AI agents in parallel, reducing noise and improving the quality of findings.

How it works

The platform allows users to build "playbooks" or workflows that chain together specific prompts. These workflows are executed by AI agents that run inside disposable Docker containers, giving them the ability to install tools, compile code, and run tests to verify vulnerabilities. The system then de-duplicates these results, ranks them by severity, and allows for the creation of proofs of concept (PoCs) and detailed reports.

Who it’s for

It is designed for security researchers and developers who want a self-hosted environment to automate vulnerability research while maintaining full control over their prompts, model providers (such as OpenAI, Anthropic, or xAI), and infrastructure.

Highlights

  • Workflow Builder: Create reusable security research playbooks by chaining focused prompts.
  • Agentic Execution: Agents run in isolated containers with internet access to build and test proofs of concept.
  • Flexible Model Support: Compatible with OpenAI, Anthropic, OpenRouter, xAI, and Codex.
  • Finding Management: Includes automatic de-duplication, custom severity ranking, and structured export of results into ZIP archives.

Related

  • Project
    vercel-labs/deepsec

    An agent-powered vulnerability scanner for large-scale repositories that uses AI to find and verify deep-seated security issues.

  • Project
    AISecurityLab/hackagent

    A security red-teaming toolkit for AI agents that automates the discovery of vulnerabilities like prompt injection and jailbreaking using research-backed attack techniques.

  • Dispatch
    OpenAI Codex Security Research Preview

    OpenAI has introduced Codex Security, an application security agent that uses frontier models and automated validation to identify high-confidence vulnerabilities and provide actionable fixes.

  • Project
    google/mantis

    A portable toolkit and agentic framework for automating the discovery, reproduction, and patching of software vulnerabilities to build more secure code.

  • Project
    openai/codex-security

    A CLI and TypeScript SDK for defining security policies and using AI to find, validate, and fix security vulnerabilities in codebases.