----------------
🛠️ Tool
===================
open·kritt is an open-source, self-hosted security research platform that orchestrates AI agents to find vulnerabilities in code. Rather than pointing a model at an entire repository and hoping for results, it breaks research into focused, well-defined tasks, runs them in parallel across AI agents, and combines output into validated, prioritized findings.
How it works
The core approach is decomposition. Full-repository scans with a single LLM prompt tend to produce noisy, unfocused results. open·kritt chains focused prompts into reusable security research playbooks (workflows). Each workflow defines a sequence of targeted analysis steps. Agents run these steps in parallel, and results are merged with automatic de-duplication and custom severity ranking.
Key capabilities
• Workflow builder: Chain focused prompts into reusable security research playbooks
• Scan execution: Analyze remote or local repositories and dependencies using Codex or Claude Code
• Finding validation: Post-scripts verify issues, build proofs of concept, produce reports
• Result prioritization: Custom severity rankers, consistent finding schema, automatic de-duplication
• Model flexibility: Bring your own model access via Codex, OpenAI, Anthropic, or OpenRouter
Technical details
The stack runs on Docker with Docker Compose, requiring Node.js 20 or newer. The CLI is repository-local with no separate install step. Default ports bind to 127.0.0.1, and the backend ships without application authentication. The documentation explicitly advises keeping the stack private.
Tool-enabled agents run as root inside disposable job containers, with writable repository copies and direct internet access. This allows agents to install tools, compile targets, run tests, and build proofs of concept. The threat model documentation recommends running open·kritt on a dedicated Docker host or VM, especially when scanning untrusted code.
Background
The Kritt team built this from real security research. Under the researcher name Blockian, they earned over $1,500,000 in bug-bounty payouts across platforms including Immunefi and HackenProof. open·kritt is the open-source version of the internal tool behind that work.
Limitations
No application-level authentication by default. Agents run as root in containers with internet access, requiring isolation awareness. The tool has not been independently verified for this writeup.
🔹 openkritt
#tool #AI #vulnerability #bugbounty
🔗 Source:
https://github.com/Kritt-ai/open-kritt
https://sekurak.pl Account by @kkrenski
