open·kritt

What is open·kritt?

open·kritt is an open-source platform from the Kritt team for AI-assisted vulnerability research. Rather than pointing a model at a whole repository, you build a workflow, a tree of small prompt steps whose outputs feed the next step, and the engine fans work out to agents in parallel, one per entry point, file or hypothesis. A scan applies a workflow to a target repository using the model and harness you pick, then post-scripts check each finding, produce a proof of concept or draft a report, and severity rankers de-duplicate and rank the results using rules you write. The engine is self-hosted under AGPL-3.0 with your own model keys, and the site mentions Codex, Claude Code and OpenRouter as options, plus targets on local disk or GitHub. Self-hosting is not offline, because repository contents and prompts go to the model endpoint you configure. Kritt also sells a managed scan at $5,000 per scan for up to 200,000 lines of code, which requires identity verification, and offers enterprise coverage on a custom basis.

Use cases

• Hunt for vulnerabilities in a codebase with AI agents
• Build reusable security research workflows
• Validate findings and build proofs of concept
• Rank and de-duplicate security findings
• Audit a repository you own for secure coding
• Order a managed code security scan

Who it's for

• Security researchers
• Bug bounty hunters
• Security-minded developers
• AppSec teams

Why use open·kritt

• Breaks a broad review into small tasks, which the project says is where AI finds real bugs more often.
• Keeps prompts, workflows, credentials and data under your control when you run the engine yourself.
• Separates how to search (the workflow) from what to search and how to process results (the scan), so one workflow can be reused across repositories.
• Adds validation, de-duplication and ranking so you review fewer raw candidates.
• Offers a managed route when you want Kritt's team to run its own workflows for a fixed per-scan fee.

open·kritt features

• Workflow builder that chains focused prompt steps
• Parallel agent runs across functions, files and hypotheses
• Scans of local or remote GitHub repositories and dependencies
• Post-scripts that check exploitability, produce a PoC or draft a report
• Severity rankers written as markdown rules
• Automatic de-duplication with a fixed finding schema
• Built-in basic workflows, including an entrypoint-driven vulnerability hunt
• Works with Codex, Claude Code or OpenRouter model access
• Docker-based install with a guided CLI setup

open·kritt integrations

• Codex
• Claude Code
• OpenRouter
• OpenAI
• Anthropic
• GitHub
• Docker

How to get started with open·kritt

1. Clone the repository and run the setup command, or bring up the Docker stack and set model access through the guided CLI.
2. Build or pick a workflow, such as the built-in entrypoint-driven hunt, and choose your model and harness.
3. Create a scan against a local or GitHub repository, adding dependencies, repeat settings and a ranker if needed.
4. Agents run the workflow steps in parallel and produce candidate findings.
5. Post-scripts validate findings and the ranker de-duplicates and orders them; export the results.

open·kritt limitations

• Self-hosted does not mean offline: repository contents and prompts go to your configured model endpoint
• AGPL-3.0 requires publishing modified source if you run it as a network service
• Some of Kritt's proven workflows are private and only used in the managed scan
• Managed scans require KYC and manual approval
• A community workflow marketplace is planned but not yet available

open·kritt pricing

open·kritt is open source, so you can use and self-host it for free. Paid plans start at $5,000 usage-based, according to the official pricing page on 24 Oct 2026.

open·kritt plans

• open·kritt

  Free

  self-hosted, AGPL-3.0

  • Local or remote repositories
  • Bring Codex or Claude Code
  • Custom workflows and agent skills

• Single Scan

  $5,000 per scan

  up to 200,000 lines of code

  • Written report of findings
  • Email support during the scan
  • Scope and authorization review

• Enterprise

  Custom

  • Dedicated support
  • CI/CD integrations
  • Scanning of PRs and releases
  • Custom LOC volumes and SLAs

Plans as listed on the official pricing page on 24 Oct 2026. Prices can change and may vary by country or exclude tax. Check the official pricing page.

open·kritt alternatives

The main open·kritt alternatives listed on Debuly are Semgrep, Corgea, Veracode, Nullify, Corridor and Bodega One Code. The table compares pricing and platforms; order is A–Z.

1. 

   Bodega One Code

   Free local-first AI coding agent and full IDE that runs parallel background agents on your machine with any local or cloud model you bring.

   CodingDeveloper platformsAutomation and agents
   FreeVisit Bodega One Code (official site)
2. 

   Corgea

   AI-native application security platform that scans code, dependencies, containers and infrastructure and proposes fixes in pull requests.

   CodingDeveloper platformsAutomation and agents
   FreemiumVisit Corgea (official site)
3. 

   Corridor

   AI code security tool that reviews pull requests and steers AI coding agents toward secure code as it is generated.

   CodingDeveloper platforms
   Free trialVisit Corridor (official site)
4. 

   Nullify

   Autonomous product security platform that finds vulnerabilities, proves exploitability and opens merge-ready fix pull requests.

   CodingAutomation and agentsDeveloper platforms
   Contact salesVisit Nullify (official site)
5. 

   Semgrep

   Application security platform for static analysis, supply chain and secrets scanning, with AI-assisted triage and fixes for developers and coding agents.

   Developer platformsCoding
   FreemiumVisit Semgrep (official site)
6. 

   Veracode

   Application security platform for static, dynamic and open-source scanning, supply chain protection and AI-assisted fixes.

   Developer platformsCoding
   Contact salesVisit Veracode (official site)

open·kritt FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from kritt.ai · fetched 24 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.