Topic

#devtools

Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.

#devtools

Loot

More from this topic

Explore all loot

Run focused AI vulnerability scans with open-kritt

#security #ai-agents+4

A self-hosted security research workbench that turns Codex or Claude Code agents into focused, de-duplicated vulnerability scans. open-kritt is a self-hosted security research platform for developers and bug-bounty teams that want AI agents to inspect code in smaller, repeatable workflows instead of asking one model to audit an entire repository at once. It lets you build prompt-based scan workflows, run them with Codex or Claude Code, validate findings with post-scripts, rank severity, and de-duplicate results before review. Why it is useful: It is aimed at practical code-security work: scoped scans, reusable workflows, findings, ranking, and proof-building rather than generic chat. It supports model access through Codex, OpenAI, Anthropic, or OpenRouter, so teams can choose the provider path that fits their setup. The project is open source under AGPL-3.0 and includes a local Docker Compose stack plus a repository-local ./kritt CLI. Use it carefully. The project documentation states that tool-enabled scan agents run as root inside disposable containers with writable repository copies and direct internet access. The backend is unauthenticated by default. That makes open-kritt best suited for a dedicated VM or isolated Docker host, with scoped credentials and network controls, especially when scanning untrusted or private repositories. A good first evaluation path is to read the threat model, clone the repository on an isolated machine, run ./kritt setup, configure one model-access option, and scan a small non-sensitive repository before connecting private code.

Free

Review open