Purpose
open·kritt is aimed at security researchers and security-conscious developers, and is designed to solve the inefficient practice of "handing the entire repository to a model and asking it to find vulnerabilities." It takes a focused approach: breaking vulnerability research into small, well-defined tasks, running them in parallel across AI agents, and then merging the outputs of each agent into verifiable, prioritizable findings. The platform gives users control over their own prompts, workflows, model providers, and infrastructure.
Main Capabilities
- Build workflows: Chain focused prompts into reusable security research playbooks.
- Run scans: Use Codex, Claude Code, or Grok Build to analyze remote or local repositories and their dependencies.
- Verify findings: Validate issues through post-scripts, build proofs of concept, and generate reports.
- Export scan results: Package normalized findings, structured data, post-processing outputs, reports, and proofs of concept into a ZIP archive, along with a shared security manifest; completed scans produce a full export, while stopped or failed scans with findings produce a clearly marked partial export. Attacker-influenced reports and PoC source content are preserved as plain text.
- Prioritization: Apply custom severity sorters, a unified findings structure, and automatic deduplication.
- Bring your own model access: Use Codex login, or connect through OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI.
How to Use
Before starting, Git, Docker and Docker Compose, and Node.js 20 or later are required. The repository's local CLI has no installation step. After running the stack, open http://localhost:5173。只需一种模型访问方式即可，./kritt setup will guide you through the available login and API key configuration. GITHUB_TOKEN is optional and is only needed when accessing private GitHub repositories.
On a server without a browser or desktop, you can keep the stack running and open another shell to use the headless CLI. The headless CLI can import portable workflows, post-scripts, skills, and sorter JSON; create scans (using the same backend validation as the web form); display scan status, phase, and failure reason; edit non-secret runtime settings; and export findings packages. It does not display findings content in the terminal.
By default, ports are bound to 127.0.0.1, and the backend does not include application authentication, so the stack should be kept private. In Accounts, a persistent Active toggle can be used to choose which accounts can receive new assignments while retaining other credentials.
Use Cases
Suitable for security researchers and security-conscious developers for focused vulnerability discovery, verification, and report generation on code repositories and their dependencies. It is also suitable for security teams that need self-hosting and control over prompts, workflows, and model providers. The Kritt team, under the name Blockian, has earned more than $1.5 million cumulatively in bug bounties, and open·kritt is an open-source distillation of the internal project that supported this work.
Limitations and Security Considerations
Agents with tools enabled run as root inside disposable job containers, with a writable repository copy and direct internet access, in order to install tools, compile targets, run tests, and build proofs of concept. Therefore, open·kritt should be run on a dedicated Docker host or virtual machine, and the threat model should be reviewed before scanning untrusted code. Because the backend does not include application authentication and the default ports are bound only locally, the stack should be kept private. The project is licensed under the GNU Affero General Public License v3.0.
