agentgg-dev/agentgg

What it solves

agentgg is a security scanner that finds vulnerabilities in source code. Unlike traditional static analysis tools that rely on pattern matching, agentgg uses AI agents that actually read and reason about the code. This means it can follow imports, understand the call graph, and confirm a finding before reporting it, reducing false positives.

How it works

Each scan starts with a fast recon pass that briefs the agents on what the project is. Then agents, defined as markdown files with YAML frontmatter (declaring where to look and an optional precondition), are run. They can search the whole repository or just a diff. The scanner supports scanning a full repo or a git diff for pull request review. Output includes a summary and per-finding markdown files, plus a state directory that allows resuming interrupted scans, checking status, and revalidating. It integrates with multiple LLM providers (Anthropic, OpenAI, Bedrock, Vertex AI, OpenRouter, or local Ollama).

Who it's for

Developers and security teams who want a more intelligent, context-aware SAST scanner that can be used locally via CLI or as a hosted service. It's designed to be CI-ready and works well for pull request reviews. Users need some familiarity with LLM providers to obtain an API key.

Highlights

• Agentic reasoning over pattern matching: agents read code, follow imports, and verify findings.
• Works on whole repos or git diffs for PR review.
• Resume support: interrupted scans can be resumed on re-run.
• Agent catalog auto-downloads from a GitHub repo; users can write custom agents.
• Supports multiple LLM providers, including local Ollama.
• Includes a local web UI to browse findings (agentgg view).
• Live validation (--live-validate) uses Docker to confirm findings.