Open Kritt, a self-hosted platform that orchestrates AI agents to find and validate security vulnerabilities in code, published on GitHub this week under an AGPL-3.0 license, according to the project's repository.
The tool lets researchers build scanning workflows with focused prompts, run parallel scans across repositories and dependencies, and verify findings through post scan scripts before exporting results as structured archives, the repository says. It supports multiple AI providers, including Codex, Claude, OpenAI and OpenRouter, and includes deduplication and severity ranking, according to the project.
The tool is built as a full-stack JavaScript application deployed with Docker, with separate frontend, backend, engine, database and executor services, the repository says. Its documentation warns that agents run as root inside disposable containers and advises against scanning untrusted code.
The project is maintained by Harel Rom and Gabriel Balko, who say they have earned more than $1.5 million in bug bounties under the handle "Blockian" across multiple platforms, according to the repository. They describe the tool as a distillation of that research process.
For security teams evaluating agent driven scanning tools, the root in container warning is worth reading closely before pointing this at anything besides code the team already trusts. The same agentic pattern that finds real bugs faster also runs arbitrary code with elevated privileges.