Description
Point a big model at a whole repo and say "find me bugs," and you mostly get scary-looking findings that don't reproduce — the hard part of AI vulnerability research isn't whether it can find, but getting it to report less noise and actually reproduce. open-kritt takes a different tack: instead of making one model chew through everything, it breaks the code's entry points and paths into small, well-defined research tasks and lets multiple AI agents track them in parallel.
Each agent runs in a disposable container with a writable copy of the code and internet access — it can install tools, compile targets, run tests, and when needed do fuzzing and PoC validation, so what comes back isn't "suspected" but a conclusion with a working exploit path and proof. The parallel outputs are merged under one finding schema, automatically de-duplicated and ranked by severity, then packaged into an export with PoCs and reports. The whole engine is self-hosted, plugs into Codex or Claude Code, and keeps the workflows, prompts and compute in your hands. Use it on code you're authorized to audit, and run it on a dedicated host or VM per the official threat model — don't point it at untrusted repositories.
Task decomposition · parallel agents: Analyze entry points and paths first, split the research into small well-defined tasks, and dispatch them to multiple AI agents in parallel instead of one model brute-forcing the whole repo.
Isolated-environment validation: Each agent analyzes code and runs tests in a disposable container, with fuzzing and PoC building available, so findings actually reproduce rather than staying guesses.
De-duplication and severity ranking: Merge parallel output under a consistent finding schema, de-duplicate automatically, and apply custom severity rankers to push noise down and real issues up.
Reusable workflows: Chain focused prompts into security-research playbooks you reuse across scans of remote or local repositories and their dependencies.
One-click export: Package canonical findings, structured data, post-processing output, reports and PoCs into a single ZIP; stopped or failed scans still export clearly marked partial results.
Bring your own model · self-hosted: Connect a Codex login or OpenAI, Anthropic, OpenRouter, xAI; deploy the whole engine yourself under AGPL-3.0, with data staying on your machine.
Each agent runs in a disposable container with a writable copy of the code and internet access — it can install tools, compile targets, run tests, and when needed do fuzzing and PoC validation, so what comes back isn't "suspected" but a conclusion with a working exploit path and proof. The parallel outputs are merged under one finding schema, automatically de-duplicated and ranked by severity, then packaged into an export with PoCs and reports. The whole engine is self-hosted, plugs into Codex or Claude Code, and keeps the workflows, prompts and compute in your hands. Use it on code you're authorized to audit, and run it on a dedicated host or VM per the official threat model — don't point it at untrusted repositories.
Features
Task decomposition · parallel agents: Analyze entry points and paths first, split the research into small well-defined tasks, and dispatch them to multiple AI agents in parallel instead of one model brute-forcing the whole repo.
Isolated-environment validation: Each agent analyzes code and runs tests in a disposable container, with fuzzing and PoC building available, so findings actually reproduce rather than staying guesses.
De-duplication and severity ranking: Merge parallel output under a consistent finding schema, de-duplicate automatically, and apply custom severity rankers to push noise down and real issues up.
Reusable workflows: Chain focused prompts into security-research playbooks you reuse across scans of remote or local repositories and their dependencies.
One-click export: Package canonical findings, structured data, post-processing output, reports and PoCs into a single ZIP; stopped or failed scans still export clearly marked partial results.
Bring your own model · self-hosted: Connect a Codex login or OpenAI, Anthropic, OpenRouter, xAI; deploy the whole engine yourself under AGPL-3.0, with data staying on your machine.
