{"slug": "show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research", "title": "Show HN: Open-Kritt – Open-source infrastructure for AI-based security research", "summary": "The Kritt team, which has earned over $1,500,000 in bug-bounty payouts under the researcher name Blockian, has launched Open-Kritt, an open-source, self-hosted security research platform that orchestrates AI agents to find real vulnerabilities in code. The platform breaks research into small tasks run across AI agents in parallel, producing de-duplicated, ranked findings with configurable validation and enrichment, and supports model providers including OpenAI, Anthropic, and OpenRouter.", "body_md": "**Orchestrate AI agents to find real vulnerabilities in code.**\n\nAn open-source, self-hosted security research platform that turns focused AI analysis into de-duplicated, ranked findings with configurable validation and enrichment.\n\n[Website](https://kritt.ai) ·\n[Documentation](https://docs.kritt.ai) ·\n[Getting started](https://docs.kritt.ai/getting-started/installation-and-setup) ·\n[Contributing](/Kritt-ai/open-kritt/blob/main/CONTRIBUTING.md) ·\n[Research paper](https://kritt.ai/open-kritt-launch) ·\n[Discord community](https://t.co/WzXMUKWxcR) ·\n[Twitter](https://x.com/Kritt_AI)\n\nPointing a model at an entire repository and asking it to find vulnerabilities rarely works well. open·kritt takes a focused approach: break the research into small, well-defined tasks, run them across AI agents in parallel, and combine their output into findings you can validate and prioritize.\n\nIt is built for security researchers and security-minded developers who want control over their prompts, workflows, model providers, and infrastructure.\n\n**Build workflows**— chain focused prompts into reusable security research playbooks.** Run scans**— analyze remote or local repositories and their dependencies with Codex or Claude Code.** Verify findings**— use post-scripts to validate issues, build proofs of concept, and produce reports.** Prioritize results**— apply custom severity rankers, a consistent finding schema, and automatic de-duplication.** Bring your own model access**— use a Codex login or connect through OpenAI, Anthropic, or OpenRouter.\n\nBuilt from real security research.The Kritt team has earned over$1,500,000 in bug-bounty payoutsunder the researcher nameBlockian([Immunefi]·[HackenProof]·[blockian.xyz]·[@ControlZ_1337]). open·kritt is the open-source distillation of the internal project behind that work.\n\nYou need Git, Docker with Docker Compose, and Node.js 20 or newer. The repository-local CLI has no install step.\n\n```\ngit clone https://github.com/Kritt-ai/open-kritt\ncd open-kritt\n./kritt setup\n./kritt start\n```\n\nOpen [http://localhost:5173](http://localhost:5173) once the stack is running. You only\nneed one model-access option; `./kritt setup`\n\nguides you through the available logins and\nAPI keys. A `GITHUB_TOKEN`\n\nis optional and only needed for private GitHub repositories.\n\nThe default ports bind to `127.0.0.1`\n\n, and the backend does not include application\nauthentication. Keep the stack private.\n\nTool-enabled agents run as root inside disposable job containers, with writable repository\ncopies and direct internet access so they can install tools, compile targets, run tests,\nand build proofs of concept. Run open·kritt on a dedicated Docker host or VM; see the\n[threat model](/Kritt-ai/open-kritt/blob/main/docs/threat-model.md) before scanning untrusted code.\n\nFor prerequisites, manual Docker setup, and provider-specific instructions, read the\n[installation guide](/Kritt-ai/open-kritt/blob/main/docs-site/getting-started/installation-and-setup.mdx) and\n[AI provider setup](/Kritt-ai/open-kritt/blob/main/docs-site/ai-provider-setup/overview.mdx).\n\nPreview the documentation locally with Mint:\n\n```\nnpm install -g mint\ncd docs-site\nnpm run dev\n```\n\nOpen [http://localhost:3001](http://localhost:3001) to view the site.\n\nQuestions and ideas belong in [GitHub Discussions](https://github.com/Kritt-ai/open-kritt/discussions).\nUse [GitHub Issues](https://github.com/Kritt-ai/open-kritt/issues) for bugs and feature\nrequests.\n\nContributions are welcome. Read [CONTRIBUTING.md](/Kritt-ai/open-kritt/blob/main/CONTRIBUTING.md) for the development\nsetup, test commands, Conventional Commits, and DCO sign-off requirements.\n\nPlease report security vulnerabilities privately by following [SECURITY.md](/Kritt-ai/open-kritt/blob/main/SECURITY.md), not through a public issue.\n\nopen·kritt is licensed under the [GNU Affero General Public License v3.0](/Kritt-ai/open-kritt/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research", "canonical_source": "https://github.com/Kritt-ai/open-kritt", "published_at": "2026-07-21 11:32:04+00:00", "updated_at": "2026-07-21 11:52:53.428325+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-research", "ai-safety", "developer-tools"], "entities": ["Kritt", "Blockian", "OpenAI", "Anthropic", "OpenRouter", "Immunefi", "HackenProof", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research", "markdown": "https://wpnews.pro/news/show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research.md", "text": "https://wpnews.pro/news/show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research.txt", "jsonld": "https://wpnews.pro/news/show-hn-open-kritt-open-source-infrastructure-for-ai-based-security-research.jsonld"}}