Open-Kritt Orchestrates Parallel AI Agents for Self-Hosted Code Vulnerability Research
Open-Kritt is an open-source platform that decomposes vulnerability discovery into parallel agentic tasks instead of querying entire codebases with single prompts. It supports BYO-model keys across Anthropic, OpenAI, and DeepSeek, automatically compiling PoC exploits.
Why it matters
You can run automated, multi-model security audits on private repositories without exposing source code to commercial software-as-a-service scanners.
TL;DR
- 01Splits codebase audits into small, focused sub-tasks run by parallel agents to cut hallucination rates.
- 02Generates reproducible proof-of-concept scripts and unified severity rankings for verified bugs.
- 03Requires execution in dedicated VMs because Docker runner agents execute with root privileges.
Key facts
- License
- AGPL-3.0
- Runtime Dependencies
- Git, Docker with Docker Compose, Node.js 20+
- Supported Providers
- OpenAI, Anthropic, DeepSeek, OpenRouter, xAI, Codex
- Default Binding
- 127.0.0.1:5173 (No auth)
Decomposed Agentic Architecture
Directing an LLM against a monolithic codebase creates noisy, unranked results. open-kritt breaks repository auditing into discrete execution phases. Multi-agent workflows inspect local or remote repositories in parallel using Codex, Claude Code, or Grok Build, routing outputs into an automated deduplication and custom severity-ranking engine.
Execution Sandbox and Threat Model
Running agent-driven penetration testing requires strict environment boundaries:
- Root Container Execution: Job agents run as
rootinside ephemeral Docker containers with repository write access and outbound internet connectivity to compile dependencies and verify exploits. - Authentication Limits: The web backend binds to
127.0.0.1:5173without built-in application-layer auth. It is designed solely for private environments and must not be exposed directly to networks. - Model Flexibility: Supports Bring-Your-Own-Key access for Anthropic, OpenAI, DeepSeek, OpenRouter, and xAI, as well as native Codex logins.
Headless Mode and Report Exports
Scans export full findings, machine-readable manifests, and PoC sources into portable ZIP archives. For automated CI/CD pipelines, ./kritt-headless provides terminal progress tracking across scan phases while preserving findings in structured report files.
Try it in 2 minutes
git clone https://github.com/Kritt-ai/open-kritt
cd open-kritt
./kritt setup
./kritt startbash
✓ When to use
- Auditing internal, proprietary source code that cannot be shared with third-party software-as-a-service scanners.
- Automating proof-of-concept exploit creation and verification across large codebases using parallel models.
✕ When NOT to use
- Auditing untrusted code directly on your primary workstation without an isolated virtual machine.
- Deployments requiring public internet exposure without an authenticated reverse proxy.
What to do today
- Provision an isolated VM or dedicated Docker host prior to scanning untrusted code repositories.
- Run `./kritt setup` to bind credentials for Anthropic, OpenAI, or DeepSeek API providers.