---
title: "Welcome to open·kritt"
description: "Orchestrate AI agents to find real vulnerabilities in code."
---
open·kritt is an open-source, AI-driven security research platform. Instead of pointing
a model at a whole repository and hoping, you break the work into small, well-defined
tasks, run them across AI agents in parallel, and turn the results into de-duplicated,
ranked findings you can validate and enrich with per-finding post-scripts.
## Who it's for
Fold AI into your research process without giving up control over prompts, data, or
models.
Get AI help writing - and auditing - secure code against a repository you own.
**From the team at Kritt.** We built and used this system internally to find real,
high-impact vulnerabilities, earning **over $1,500,000 in bug-bounty payouts** under the
researcher name **Blockian**
([Immunefi](https://immunefi.com/profile/Blockian/) ·
[HackenProof](https://hackenproof.com/hackers/Blockian) ·
[blockian.xyz](https://blockian.xyz) · [@Kritt_AI](https://x.com/Kritt_AI)).
open·kritt is the open-source distillation of that workflow.
## The idea
If you point an AI at a whole repository and ask "find the vulnerabilities," it usually
won't. But if you point it at **one function in one file** and ask a focused question, it
often will. The most effective way to use AI for security research is to give it small,
well-defined, digestible tasks.
open·kritt is deliberately opinionated. It gives you freedom where it matters - your
prompts, your data, your models - and enforces structure where it pays off: a fixed
finding schema, automatic de-duplication, per-finding follow-up scripts, and severity
ranking.
You do not have to begin with a blank workflow. open·kritt includes a
[built-in entrypoint-flow workflow](/workflows/built-in-workflows) that you can inspect,
run, and adapt. An open marketplace for sharing and discovering community workflows is
planned.
## How the pieces fit together
A reusable blueprint: a tree of prompt **steps** the engine runs, feeding each step's
output into the next.
Per-finding follow-up that runs after the workflow - validate a finding, build a PoC,
or write a report.
Markdown rules that tell the model how to prioritize findings for your program.
A single run of a workflow against a target repository, with your chosen model and
harness.
## What happens in a scan
Steps execute in depth order and turn focused analysis tasks into candidate findings.
open·kritt automatically clusters duplicates and ranks the canonical findings using
the scan's severity rules.
One or more post-scripts run on each canonical finding to add verdicts, reports,
proofs of concept, and other structured context. Post-scripts enrich the result; they
do not silently delete it.
## Next steps
Start from preinstalled research patterns and learn about the upcoming open workflow
marketplace.
Install the Docker stack and configure model access through the guided CLI.
Configure Codex, Claude Code, or OpenRouter and understand how each option is billed.
Build a workflow, add a post-script and a ranker, and scan a repo end to end.
Understand what you get from the open-source project versus a managed Kritt scan.