open-kritt
An open-source, self-hosted AI security and vulnerability research platform that decomposes vulnerability research into multiple small tasks executed in parallel by multiple AI agents. It outputs deduplicated, ranked and verifiable findings, and supports bring-your-own model access.
Timeline (last 90 days)
open-kritt is an open-source, self-hosted AI security and vulnerability research platform written in JavaScript.
open-kritt's core idea is to break vulnerability research down into many small tasks, executed in parallel by multiple AI agents and then merged into deduplicated, ranked, verifiable findings, rather than relying on a single giant prompt.
open-kritt is described as an open-source distilled version of the Kritt team's internal toolchain.
open-kritt supports core functions including building workflows, running scans, verifying findings, exporting scan results, ranking results, and bringing your own model access.
open-kritt scans support Codex, Claude Code, or Grok Build, and model access can be via Codex login or through OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI.
open-kritt's prerequisites are Git, Docker (including Docker Compose), and Node.js 20 or newer.
open-kritt has no application-layer authentication by default, binds to 127.0.0.1 on its default port, and the entire service should be kept private and not exposed externally.
./kritt-headless does not display the specific contents of vulnerability findings in the terminal, only the scan status, phase, and reason for failure.
open-kritt uses the AGPL-3.0 license.
All Facts (9)
open-kritt is an open-source, self-hosted AI security and vulnerability research platform written in JavaScript.
50%Unverifiedopen-kritt's core idea is to break vulnerability research down into many small tasks, executed in parallel by multiple AI agents and then merged into deduplicated, ranked, verifiable findings, rather than relying on a single giant prompt.
50%Unverifiedopen-kritt is described as an open-source distilled version of the Kritt team's internal toolchain.
50%Unverifiedopen-kritt supports core functions including building workflows, running scans, verifying findings, exporting scan results, ranking results, and bringing your own model access.
50%Unverifiedopen-kritt scans support Codex, Claude Code, or Grok Build, and model access can be via Codex login or through OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI.
50%Unverifiedopen-kritt's prerequisites are Git, Docker (including Docker Compose), and Node.js 20 or newer.
50%Unverifiedopen-kritt has no application-layer authentication by default, binds to 127.0.0.1 on its default port, and the entire service should be kept private and not exposed externally.
50%Unverified./kritt-headless does not display the specific contents of vulnerability findings in the terminal, only the scan status, phase, and reason for failure.
50%Unverifiedopen-kritt uses the AGPL-3.0 license.
50%