Welcome to open·kritt
open·kritt is an open-source, AI-driven security research platform. Instead of pointing a model at a whole repository and hoping, you break the work into small, well-defined tasks, run them across AI agents in parallel, and turn the results into de-duplicated, ranked findings you can validate and enrich with per-finding post-scripts.
Who it's for
Fold AI into your research process without giving up control over prompts, data, or models.
Get AI help writing - and auditing - secure code against a repository you own.
The idea
If you point an AI at a whole repository and ask "find the vulnerabilities," it usually won't. But if you point it at one function in one file and ask a focused question, it often will. The most effective way to use AI for security research is to give it small, well-defined, digestible tasks.
open·kritt is deliberately opinionated. It gives you freedom where it matters - your prompts, your data, your models - and enforces structure where it pays off: a fixed finding schema, automatic de-duplication, per-finding follow-up scripts, and severity ranking.
You do not have to begin with a blank workflow. open·kritt includes a built-in entrypoint-flow workflow that you can inspect, run, and adapt. An open marketplace for sharing and discovering community workflows is planned.
How the pieces fit together
A reusable blueprint: a tree of prompt steps the engine runs, feeding each step's output into the next.
Per-finding follow-up that runs after the workflow - validate a finding, build a PoC, or write a report.
Markdown rules that tell the model how to prioritize findings for your program.
A single run of a workflow against a target repository, with your chosen model and harness.
What happens in a scan
Run the workflow
Steps execute in depth order and turn focused analysis tasks into candidate findings.
Combine and prioritize
open·kritt automatically clusters duplicates and ranks the canonical findings using the scan's severity rules.
Validate and enrich
One or more post-scripts run on each canonical finding to add verdicts, reports, proofs of concept, and other structured context. Post-scripts enrich the result; they do not silently delete it.
Next steps
Start from preinstalled research patterns and learn about the upcoming open workflow marketplace.
Install the Docker stack and configure model access through the guided CLI.
Configure Codex, Claude Code, or OpenRouter and understand how each option is billed.
Build a workflow, add a post-script and a ranker, and scan a repo end to end.
Understand what you get from the open-source project versus a managed Kritt scan.