Local vs remote targets

A scan targets either a remote repository (cloned from GitHub) or a local one (a folder you've made available to the engine). Toggle between them at the top of the target section.

Remote targets

Choose Remote and provide:

• repository - a GitHub owner/repo (URLs and SSH forms are accepted and normalized).
• commit_sha - the commit to pin to; defaults to HEAD.

The engine clones the repo and checks out that commit, so scans are reproducible against a fixed point in history.

Local targets

Choose Local and pick a folder from those mounted under the engine's local-repos path (LOCAL_REPOS_PATH, default /local_repos). Each immediate sub-directory there is treated as a selectable source folder. It does not need to be a Git repository.

In the supplied Compose configuration, the root .env value is a host path and is bind-mounted to the fixed container path:

Location	Default	Example target
Host	LOCAL_REPOS_PATH=./local_repos	./local_repos/my-service
Backend/engine containers	/local_repos	/local_repos/my-service
UI/API repo_full value	Immediate folder name only	my-service

Populate the host directory before opening the scan form:

mkdir -p ./local_repos
cp -R /path/to/my-service ./local_repos/my-service
curl http://127.0.0.1:3002/api/local-repos

Do not send ./local_repos/my-service, /local_repos/my-service, or a nested name such as team/my-service as repo_full; local selections must be one folder directly below the configured host root. The mount is live for discovery, but each scan receives its own fixed snapshot when it starts.

When the scan starts, open·kritt takes one working-tree snapshot of the selected folder. The snapshot includes modified and untracked files but excludes .git. It remains fixed for the entire scan, including resumed work; create a new scan to capture changes made afterward. If the folder is a Git repository, branch and commit metadata may still appear for context, but they do not define the snapshot contents.

Warning

The selected model provider receives the local snapshot contents during analysis. Because modified and untracked files are included, review the folder for credentials or other sensitive files before starting the scan.

Note

Use local targets for private code you don't want to clone from a remote, for work-in-progress branches, or for repos that aren't on GitHub. Use remote for reproducible scans pinned to a specific commit. Private GitHub targets require a narrowly scoped GITHUB_TOKEN.

repo_scope

Either way, set repo_scope to a short description of what the scan should focus on (defaults to "full repository"). It's available to prompts as {{repo_scope}}, so your steps can honor it.

Next: dependencies.