open·kritt is a self-hosted platform for AI-assisted vulnerability research. Rather than pointing a model at an entire repository, it breaks the research into small, well-defined tasks, runs them across AI agents in parallel, and combines their output into de-duplicated, ranked findings you can validate and prioritise. It is aimed at security researchers and security-minded developers who want control over prompts, workflows, model providers, and infrastructure.
Scans run against remote or local repositories and their dependencies using Codex or Claude Code, with model access from a Codex login or keys for OpenAI, Anthropic, OpenRouter, or xAI. Workflows chain focused prompt steps into reusable playbooks; post-scripts run per finding to validate an issue, build a proof of concept, or produce a report; and custom severity rankers apply over a consistent finding schema with automatic de-duplication.
The stack runs under Docker Compose behind a web interface, and a headless CLI covers servers with no browser or desktop. It imports portable workflow, post-script, skill, and ranker JSON, creates scans with the same backend validation as the web form, reports scan status, stages, and failure reasons, edits non-secret runtime settings, and exports finding bundles — without printing finding contents to the terminal.
Deployment boundaries are stated plainly. Default ports bind to 127.0.0.1 and the backend carries no application authentication, so the stack is meant to stay private. Tool-enabled agents run as root inside disposable job containers with writable repository copies and direct internet access so they can install tools, compile targets, run tests, and build proofs of concept; a dedicated Docker host or virtual machine is the documented deployment, and a threat model covers scanning untrusted code.
Features
- Workflow builder: focused prompt steps chained into reusable security-research playbooks
- Parallel agent scans: remote or local repositories and their dependencies analysed with Codex or Claude Code
- Post-script verification: per-finding scripts that validate issues, build proofs of concept, and produce reports
- Ranking and de-duplication: custom severity rankers over a consistent finding schema
- Export bundles: canonical findings, structured data, post-processing output, reports, and proofs of concept in one ZIP with a share-safe manifest; stopped or failed scans produce clearly marked partial exports
- Headless CLI: the full scan lifecycle from a terminal, without displaying finding contents
- Bring your own model access: a Codex login, or OpenAI, Anthropic, OpenRouter, or xAI keys
- Disposable job containers: agents run in throwaway containers with writable repository copies and network access
