Welcome to open·kritt
open·kritt is an open-source, AI-driven security research platform. Instead of pointing a model at a whole repository and hoping, you break the work into small, well-defined tasks, run them across AI agents in parallel, and turn the results into ranked, verified findings.
Who it's for
Fold AI into your research process without giving up control over prompts, data, or models.
Get AI help writing - and auditing - secure code against a repository you own.
The idea
If you point an AI at a whole repository and ask "find the vulnerabilities," it usually won't. But if you point it at one function in one file and ask a focused question, it often will. The most effective way to use AI for security research is to give it small, well-defined, digestible tasks.
open·kritt is deliberately opinionated. It gives you freedom where it matters - your prompts, your data, your models - and enforces structure where it pays off: a fixed finding schema, automatic de-duplication, per-finding follow-up scripts, and severity ranking.
You do not have to begin with a blank workflow. open·kritt includes basic built-in workflows, including a battle-proven entrypoint-driven vulnerability hunt. An open marketplace for sharing and discovering community workflows is planned.
How the pieces fit together
A reusable blueprint: a tree of prompt steps the engine runs, feeding each step's output into the next.
Per-finding follow-up that runs after the workflow - validate a finding, build a PoC, or write a report.
Markdown rules that tell the model how to prioritize findings for your program.
A single run of a workflow against a target repository, with your chosen model and harness.
Next steps
Start from preinstalled research patterns and learn about the upcoming open workflow marketplace.
Install the Docker stack and configure model access through the guided CLI.
Configure Codex, Claude Code, or OpenRouter and understand how each option is billed.
Build a workflow, add a post-script and a ranker, and scan a repo end to end.
Understand what you get from the open-source project versus a managed Kritt scan.