Open Kritt

Open Kritt is a self-hosted vulnerability research platform that orchestrates AI agents to find security issues in code. Rather than pointing one model at a whole repository, it breaks the research into small, well-defined prompt steps, runs them across agents in parallel, and combines the output into de-duplicated, ranked findings that can be validated and prioritized. It targets security researchers and security-minded developers who want control over prompts, workflows, model providers, and infrastructure.

Scans cover remote or local repositories and their dependencies, with Codex, Claude Code, or Grok Build as the agent harness. Model access comes from a Codex login or from OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI accounts. Post-scripts run per finding to check exploitability, build a proof of concept, or draft a report, and custom severity rankers apply your own impact criteria over a consistent finding schema.

The stack runs in Docker with a web workflow builder and a headless CLI for servers without a browser. Tool-enabled agents run as root inside disposable job containers with internet access, and the backend has no application authentication, so the stack is meant for a dedicated private host or VM. Kritt also offers managed scans run by its own research team, built on the same engine.