Kritt

AI-assisted code security research with parallel agents and verified findings

Freemium· open-kritt: Free (self-hosted, AGPL-3.0) / Single managed scan: $5,000 (up to 200k LoC) / Enterprise: custom pricing for CI/CD integration and dedicated supportAgentsCodex and Claude Code (as agent harnesses)

Visit website →

Best for

Security researchers, appsec teams, and engineering orgs that want AI-assisted vulnerability discovery on real codebases with verified, ranked findings rather than raw LLM speculation

Skip if

Solo indie devs who just want a cheap linter, teams with strict no-AGPL policies who also cannot afford the managed tier, or shops needing a turnkey compliance SAST with certifications

Kritt is an AI-driven code security research platform that orchestrates multiple LLM agents in parallel to hunt for vulnerabilities in a codebase and then verifies the results before reporting. Rather than running a single monolithic 'AI security review' pass, Kritt first maps the attack surface of a repository, decomposes it into focused, scoped security tasks, dispatches AI agents (using Codex or Claude Code as the underlying harness) to work on each task simultaneously, then runs a verification stage that attempts to confirm exploitability and prune false positives. Findings are deduplicated and ranked using severity rules the team can customize, and the platform can generate proof-of-concept artifacts alongside the finding write-ups. It is aimed at security researchers, offensive-security teams, application-security engineers, and development teams who want continuous, semi-automated coverage of a large codebase without spinning up a team of humans to hand-review every diff. Kritt ships in two flavors: open-kritt, a fully open-source (AGPL-3.0) self-hosted build available on GitHub for teams that want to run the pipeline on their own infrastructure with their own API keys and custom workflows, and a managed service where the Kritt team runs a single scan on up to 200k lines of code for a fixed fee, or offers enterprise engagements with CI/CD integration and dedicated support. Typical workflows include one-off deep audits of a specific service before a launch, continuous scans wired into pull-request pipelines to catch regressions, targeted attack-surface reviews of newly acquired code, and bug-bounty research on open-source targets where verified, ranked findings save triage time.

Editor's take

Kritt is one of the more honest attempts I've seen at turning LLM code review into something usable: the parallel-agent + verification pipeline directly targets the false-positive problem that makes most 'AI security scanner' pitches useless. The open-source build makes it genuinely evaluable, and the flat-fee managed scan is a refreshingly clear offer. Just budget realistically for either the API bill or the $5k ticket.

— The AI Tool Bible editorial team

Pros

✅ Parallel-agent architecture covers large codebases faster than sequential AI review passes
✅ Verification stage attempts to confirm exploitability, cutting the LLM false-positive rate that plagues single-shot audits
✅ Open-source self-hosted build (AGPL-3.0) lets teams run it against private code with their own model keys
✅ Bring-your-own harness: works with Codex and Claude Code so you can pick the frontier model that fits your budget
✅ Custom severity rules and verification scripts let security teams encode their own threat model
✅ Fixed-price managed scan option ($5k up to 200k LoC) gives a predictable path for teams without in-house AI-sec expertise

Cons

⚠️ Managed scan pricing is steep for indie developers or small startups compared to traditional SAST tools
⚠️ Self-hosting still requires paying for the underlying frontier model API usage, which can be substantial on large repos
⚠️ AGPL-3.0 licensing on the open-source build is incompatible with some proprietary product integrations
⚠️ No standalone REST API documented publicly; automation lives at the CLI/workflow layer
⚠️ Effectiveness is bounded by the underlying LLMs' understanding of the language and framework; niche stacks may see weaker coverage
⚠️ Newer entrant relative to established SAST/DAST vendors, so tooling maturity and integrations are still evolving

Use cases

Pre-launch security audit of a new serviceContinuous vulnerability scanning in CI/CDBug bounty research on open-source targetsAttack-surface mapping for acquired codebasesVerified proof-of-concept generation for reported bugsCustom-rule appsec review at scaleTriage reduction for existing SAST pipelinesDeep-dive review of security-sensitive modules (auth, crypto, parsers)