Show HN: Open-Kritt – Open-source infrastructure for AI-based security research

Uh oh!

There was an error while loading. Please reload this page.

Notifications You must be signed in to change notification settings

Fork 31

Star 126

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

7 Commits

7 Commits

.github

.github

assets

assets

backend

backend

database

database

docs-site

docs-site

docs

docs

engine

engine

executor-view

executor-view

frontend

frontend

local_repos

local_repos

scripts

scripts

.editorconfig

.editorconfig

.env.example

.env.example

.gitignore

.gitignore

.pre-commit-config.yaml

.pre-commit-config.yaml

.prettierignore

.prettierignore

.prettierrc.json

.prettierrc.json

.release-please-manifest.json

.release-please-manifest.json

AGENTS.md

AGENTS.md

CHANGELOG.md

CHANGELOG.md

CODE_OF_CONDUCT.md

CODE_OF_CONDUCT.md

CONTRIBUTING.md

CONTRIBUTING.md

LICENSE

LICENSE

MAINTAINERS.md

MAINTAINERS.md

README.md

README.md

RELEASE.md

RELEASE.md

SECURITY.md

SECURITY.md

VERSION

VERSION

docker-compose.dev.yml

docker-compose.dev.yml

docker-compose.yml

docker-compose.yml

kritt

kritt

release-please-config.json

release-please-config.json

Repository files navigation

Orchestrate AI agents to find real vulnerabilities in code.

An open-source, self-hosted security research platform that turns focused AI analysis into de-duplicated, ranked findings with configurable validation and enrichment.

Website · Documentation · Getting started · Contributing · Research paper · Discord community · Twitter

What is open·kritt?

Pointing a model at an entire repository and asking it to find vulnerabilities rarely works well. open·kritt takes a focused approach: break the research into small, well-defined tasks, run them across AI agents in parallel, and combine their output into findings you can validate and prioritize.

It is built for security researchers and security-minded developers who want control over their prompts, workflows, model providers, and infrastructure.

What it does

Build workflows — chain focused prompts into reusable security research playbooks.

Run scans — analyze remote or local repositories and their dependencies with Codex or Claude Code.

Verify findings — use post-scripts to validate issues, build proofs of concept, and produce reports.

Prioritize results — apply custom severity rankers, a consistent finding schema, and automatic de-duplication.

Bring your own model access — use a Codex login or connect through OpenAI, Anthropic, or OpenRouter.

Built from real security research. The Kritt team has earned over $1,500,000 in bug-bounty payouts under the researcher name Blockian (Immunefi · HackenProof · blockian.xyz · @ControlZ_1337). open·kritt is the open-source distillation of the internal project behind that work.

Getting started

You need Git, Docker with Docker Compose, and Node.js 20 or newer. The repository-local CLI has no install step.

git clone https://github.com/Kritt-ai/open-kritt cd open-kritt ./kritt setup ./kritt start

Open http://localhost:5173 once the stack is running. You only need one model-access option; ./kritt setup guides you through the available logins and API keys. A GITHUB_TOKEN is optional and only needed for private GitHub repositories.

The default ports bind to 127.0.0.1, and the backend does not include application authentication. Keep the stack private.

Tool-enabled agents run as root inside disposable job containers, with writable repository copies and direct internet access so they can install tools, compile targets, run tests, and build proofs of concept. Run open·kritt on a dedicated Docker host or VM; see the threat model before scanning untrusted code.

For prerequisites, manual Docker setup, and provider-specific instructions, read the installation guide and AI provider setup.

Documentation

Preview the documentation locally with Mint:

npm install -g mint cd docs-site npm run dev

Open http://localhost:3001 to view the site.

Product overview

Run your first scan

Workflows and prompt steps

Security and threat model

Community and contributing

Questions and ideas belong in GitHub Discussions. Use GitHub Issues for bugs and feature requests.

Contributions are welcome. Read CONTRIBUTING.md for the development setup, test commands, Conventional Commits, and DCO sign-off requirements.

Please report security vulnerabilities privately by following SECURITY.md, not through a public issue.

License

open·kritt is licensed under the GNU Affero General Public License v3.0.

About

Orchestrate AI agents to find real vulnerabilities in code.

kritt.ai/

Topics

agent

security

ai

bug-bounty

bugbounty

agents

security-research

bugbounty-tools

Resources

Readme

License

AGPL-3.0 license

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy

Uh oh!

There was an error while loading. Please reload this page.

Activity

Custom properties

Stars

126 stars

Watchers

0 watching

Forks

31 forks

Report repository

Releases 1

v1.1.0

Latest

Jul 20, 2026

Packages 0

Uh oh!

There was an error while loading. Please reload this page.

Contributors

Uh oh!

There was an error while loading. Please reload this page.

Languages

JavaScript 50.7%

Python 42.8%

MDX 5.1%

CSS 1.1%

Dockerfile 0.2%

Shell 0.1%