knostic/OpenAnt

OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery product, helping defenders proactively find verified security flaws while minimizing both false positives and false negatives. Stage 1 detects. Stage 2 attacks. What survives is real.

What it solves

OpenAnt is designed to help software defenders proactively find verified security vulnerabilities in their code. It aims to reduce the common issues of false positives and false negatives found in traditional security scanners by using a two-stage process: detection followed by active attack verification.

How it works

The tool uses a multi-phase pipeline powered by Large Language Models (LLMs). The process is split into stages:

  1. Detection (Stage 1): The LLM identifies potential vulnerabilities.
  2. Attack (Stage 2): The tool attempts to verify the flaw by attacking it. Only vulnerabilities that survive this verification process are reported as real.

Users can configure different LLM providers (such as Anthropic, OpenAI, Google, or OpenRouter) for different phases of the pipeline (e.g., using stronger reasoning models for detection and lighter models for reporting).

Who it’s for

It is primarily intended for open-source maintainers and security researchers who want to secure their repositories. It is also provided as a tool for defenders to find flaws before attackers do.

Highlights

  • Multi-language support: Supports Go and Python, with beta support for JavaScript/TypeScript, C/C++, PHP, Ruby, Zig, Swift, and Rust.
  • Agentic Verification: Uses tool-calling capabilities of LLMs to drive the enhancement and verification phases.
  • Flexible LLM Configuration: Allows per-phase model selection to optimize for cost and performance.
  • Incremental Scanning: Supports diff-based scans (via git diff, PRs, or staged changes) to reduce token costs and time.
  • Integrated Web UI: Includes a local server for submitting repositories and viewing live scan logs and reports.

Related

  • Project
    openai/codex-security

    A CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code using AI, featuring support for multiple LLM providers and bulk scanning.

  • Project
    openhackai/OpenHack

    OpenHack is an open‑source, LLM‑driven security scanner that analyses a codebase through a recon‑→‑hunter‑→‑validator‑→‑verifier pipeline, presenting findings in an interactive terminal UI and optionally verifying exploits in Docker.

  • Project
    gadievron/raptor

    An autonomous security research framework that automates vulnerability discovery, validation, and patching using a combination of static analysis, binary analysis, and LLMs.

  • Project
    cloudflare/security-audit-skill

    A coding-agent skill that orchestrates multiple parallel agents through a six-phase pipeline to find and verify exploitable security vulnerabilities in codebases.

  • Project
    google/mantis

    A portable toolkit of skills for coding agents to enable automated, sequential security reviews, vulnerability discovery, and patching of software and hardware codebases.