Self-hosted vs managed

open·kritt comes in two forms. The open-source project is the full engine you run on your own infrastructure. The managed scan is a service where the Kritt team runs its own proven, private workflows against a target you provide.

Self-hosted (open source)

The project in this repository is licensed under AGPL-3.0 and is fully self-hosted. You get the entire platform - the workflow builder, scans, post-scripts, severity rankers, agent skills, and the orchestration engine - running on your own machines with your own model provider keys.

◆You own everything

You operate the application, database, prompts, and credentials on your infrastructure. Scan content is sent to the model endpoint you choose.

◆You author the workflows

The engine is yours, but the vulnerability-hunting strategy is up to you. You build and tune the workflows that decide what "good" looks like.

Warning

Self-hosted does not mean offline. The engine sends repository contents and prompts to the configured Codex/OpenAI, Anthropic, or OpenRouter endpoint. Tool-enabled scan jobs also have direct internet access so agents can fetch tools, dependencies, and public research. Choose providers whose data handling matches your code's sensitivity, run the stack on a dedicated Docker host or VM, and review the threat model.

Note

AGPL-3.0 is a strong network-copyleft license: if you modify open·kritt and run it as a network service, you must make your modified source available to its users. See the LICENSE for the full terms.

Managed scan (Kritt runs it for you)

The hard-won part of security research is the workflow itself - the decomposition, prompts, and guardrails that reliably surface real bugs. Those proven workflows are Kritt's core IP, so a subset of them is kept private.

With a managed scan you don't rebuild that expertise. You point us at a repository and we run our proven workflows against it, then hand you the ranked, verified findings.

1. Submit your target

   Give us the repository you want scanned.

2. Complete KYC and vetting

   Because running powerful vulnerability-finding workflows against a codebase can be abused by malicious actors, we require identity verification (KYC) and a rigorous review to confirm there is no malicious intent.

3. We scan and deliver

   Once you're approved, we run our private workflows and return the findings.

Warning

The managed scan exists precisely because this capability is dual-use. KYC and manual approval are mandatory - we do not run scans for unverified requesters.

Which should I use?

	Self-hosted	Managed scan
License / access	AGPL-3.0, open source	Kritt-operated service
Runs on	Your infrastructure	Kritt infrastructure
Workflows	You build your own	Kritt's proven private workflows
Model access and data egress	Your keys/login; content goes to your selected endpoint	Handled by Kritt
Onboarding	Clone and run	KYC + vetting required
Best for	Teams that want full control and their own strategy	Teams that want proven results without building the workflows

Ready to run it yourself? Start with installation and setup.