Kritt-ai/open-kritt

open·kritt – AI‑driven security research platform

What it is

• An open‑source, self‑hosted tool that lets security researchers run AI agents on code bases to discover real vulnerabilities.
• Rather than asking a single model to scan an entire repository, you define a workflow of small, focused prompts that run in parallel and whose results are merged, de‑duplicated, and ranked.

Core capabilities

Feature	What you get
Workflow builder	Chain together prompt steps (called skills) into reusable security playbooks.
Multi‑model support	Connect to any of Codex, Claude Code, Grok Build, or other providers via API keys or a Codex login.
Automated scans	Point the system at a local or remote repo (including dependencies) and let the agents analyse the code.
Validation & PoC generation	Post‑script steps can compile the code, run tests, and produce proof‑of‑concept exploits or verification scripts.
Result export	All findings, structured data, reports and PoCs are packaged into a single ZIP with a clear manifest.
Prioritisation	Custom severity rankers, a consistent schema, and automatic de‑duplication help you focus on the most important issues.
Headless CLI	Run scans from a terminal on servers without a GUI; the CLI mirrors the web UI’s backend logic.
Bring‑your‑own model	Use any provider you have access to – the platform does not lock you into a specific service.

How it works (high‑level flow)

1. Setup – Clone the repo, run ./kritt setup which walks you through Docker, Node, and model‑API configuration.
2. Define a workflow – Choose or author JSON‑described steps that ask an LLM to, for example, list insecure functions, suggest fixes, or generate test cases.
3. Start a scan – The backend spins up disposable Docker containers for each step, copies the target repository inside, and lets the agents run with internet access (so they can install build tools, compile, etc.).
4. Validate – Post‑scripts can compile the code, run the generated PoC, and confirm whether a reported issue is real.
5. Aggregate – Findings are de‑duplicated, ranked by your custom severity logic, and exported as a ZIP bundle.

Getting started quickly

git clone https://github.com/Kritt-ai/open-kritt
cd open-kritt
./kritt setup          # configure Docker, Node, and model credentials
./kritt start          # launches the web UI at http://localhost:5173

For servers without a browser, use ./kritt-headless which provides the same functionality via the terminal.

Typical use cases

• Bug‑bounty researchers who want reproducible, ranked vulnerability reports.
• DevSecOps teams looking to integrate AI‑assisted code review into CI pipelines (via the headless CLI).
• Security educators who can build custom teaching workflows that demonstrate how LLMs can be prompted for static analysis.

Limitations & cautions

• The agents run as root inside temporary containers and have full internet access; run the platform on an isolated host and read the included threat‑model doc.
• No built‑in authentication for the web UI – keep the service behind a firewall or on a private network.
• Results depend heavily on the quality of your prompts and the underlying model; false positives and false negatives are possible, so validation steps are essential.

Community & contribution

• Maintained by Harel Rom and Gabriel Balko; contributions are welcomed via pull requests.
• Discussions, bug reports, and feature ideas live on GitHub Discussions and Issues.
• Security‑related vulnerability reports should be sent privately as described in SECURITY.md.

License

• Distributed under the GNU Affero General Public License v3.0 (AGPL‑3.0).

---

open·kritt is a genuine AI‑agent‑powered security research platform that lets you orchestrate LLMs to find, verify, and prioritize code vulnerabilities in a controlled, reproducible way.