Get This Tool
Open-Kritt
Pricing
- Model
- Usage-Based
Summary
Security audits on large codebases stall because a single model context window runs out before the interesting code paths do — and most AI code review tools give you one shot, one thread, no parallelism. Kritt.ai exists to break that ceiling.
The tool runs parallel AI agents across a codebase, so vulnerability discovery that would serialize into hours on a single-context scan distributes across concurrent analysis threads. It targets security researchers and bug bounty teams who need to sweep repositories at scale, not review a function at a time. Self-hosting is supported under AGPL-3.0, which means your code and findings never leave your infrastructure — a requirement for any org with compliance constraints. The open-source core is inspectable and forkable, but managed scans are a paid-only feature, so teams that want the hosted workflow face a significant spend threshold. The page describes GitHub integration as a first-class path, making it a practical fit for teams already running security workflows inside existing CI infrastructure.
Bottom line: Pick Kritt.ai when you need parallelized vulnerability discovery across a large self-hosted codebase with full auditability; plan a different approach when your budget does not support managed scans and your team lacks the capacity to operate and maintain its own agent infrastructure.
Hosted & API Pricing
The model is free to self-host. These are the creator's hosted/API options.Single Scan
One security scan, written report of findings. Up to 200,000 lines of code.
- Ranked verified findings
- Written report
Pricing may have changed since last verified. Check the official site for current plans.
Community Performance Report Card
No community ratings yet. Be the first to rate this tool!
Community Benchmarks Community
Sign in to submit a benchmarkNo community benchmarks yet. Be the first to share a real-world data point.
Pros
Sign in to edit- Parallel agent analysis across large codebases, so security researchers are not bottlenecked by single-context limits that cause coverage gaps on repositories too large for one model pass.
- AGPL-3.0 open-source license with self-hosting support, which means organizations with compliance requirements can audit the tool's behavior and keep all code and findings on their own infrastructure rather than routing through a third-party service.
- Direct GitHub repository integration, so teams can point the tool at existing repos without building a separate code ingestion or preprocessing step.
- Support for Codex and Claude Code model backends, so teams can align the analysis engine with the model their organization already has access to or trusts for security-sensitive tasks.
- Inspectable agent orchestration code under an open license, which means a security team can verify exactly what the agents are executing — a requirement that opaque SaaS tools cannot satisfy.
Cons
Sign in to edit- Managed scans are a paid-only feature with a spend threshold the validator context confirms is substantial; independent researchers and small bug bounty teams operating on limited budgets hit this wall immediately and are forced to self-host, which shifts the burden of infrastructure provisioning, scaling, and maintenance entirely onto the team.
- Self-hosting the agent infrastructure requires operational capacity that security research teams — typically focused on findings, not DevOps — often lack; teams without a dedicated infrastructure engineer end up spending sprint time on setup and uptime instead of auditing, and those teams frequently abandon self-hosted options for managed security tooling that absorbs that operational cost.
- No API is available per the tool's current documentation, which means teams that want to embed Kritt.ai's analysis into an existing CI/CD pipeline or trigger scans programmatically from another system face a hard integration ceiling; teams requiring API-driven automation switch to tools with exposed endpoints.
Community Reviews
Sign in to write a reviewNo reviews yet. Be the first to share your experience.
About
- Platforms
- Local, GitHub, self-hosted
- API Available
- No
- Self-Hosted
- Yes
- Last Updated
- 2026-07-21T22:17:23.242Z
Best For
Who it's for
- Security researchers and bug bounty teams
- Developers seeking AI-assisted code audits
- Organizations requiring inspectable, self-hosted tools
- Teams using Codex or Claude Code models
What it does well
- Automated vulnerability discovery in large codebases
- Parallel AI agent analysis of security tasks
- Self-hosted security research workflows
- Integration with existing GitHub repositories
Integrations
Discussion Community
Sign in to commentNo discussion yet. Sign in to start the conversation.
Spotted incorrect or missing data? Join our community of contributors.
Sign Up to ContributeCommunity Notes & Tips Community
Sign in to contributeBe the first to contribute. General notes, observations, gotchas, and tips from people who use this tool day-to-day.
Frequently Asked Questions
- Is Open-Kritt free?
- Open-Kritt has a permanent free tier alongside paid upgrades. You can keep using a baseline version indefinitely without paying.
- Is Open-Kritt open source?
- Yes. Open-Kritt is open source.
- Can I self-host Open-Kritt?
- Yes. Open-Kritt supports self-hosting on your own infrastructure.
- When was Open-Kritt released?
- Open-Kritt was first released in 2026.
- What platforms does Open-Kritt support?
- Open-Kritt is available on: Local, GitHub, self-hosted.
Hours Saved & ROI Stories Community
Sign in to contributeBe the first to contribute. Concrete time/cost savings, with context. e.g. "Cut my code review backlog from 4h to 45m per week."
Best Open-Kritt alternatives →
Curated lists that include this category
Kritt.ai orchestrates multiple AI agents — specifically Codex and Claude Code models, per the vendor’s documentation — to analyze a codebase for security vulnerabilities in parallel rather than sequentially. The core workflow runs agents as concurrent analysis workers across code sections, surfaces findings, and integrates with GitHub repositories to pull in target code without manual export steps. This makes it possible to initiate a security research session directly from a repo rather than standing up a separate ingestion pipeline.
The defining technical decision is the parallel agent architecture. Where a single-context AI audit hits a wall when a codebase exceeds the model’s window, Kritt.ai distributes the work so multiple agents analyze different surfaces simultaneously. The vendor describes this agent coordination throughout the site, and it is the architectural reason the tool targets large codebase audits rather than spot checks on isolated files.
Self-hosting under AGPL-3.0 is the trust anchor for security-sensitive organizations. Because the license is copyleft and the source is inspectable, teams can verify exactly what the agents are doing with their code — a prerequisite for organizations that cannot route proprietary or regulated codebases through third-party infrastructure. The tradeoff is operational burden: self-hosting means your team owns the setup, scaling, and uptime of the agent infrastructure. Managed scans, which offload that burden, are a paid-only feature that the validator context confirms carries a high entry cost, making the hosted option inaccessible for independent researchers or small teams on limited budgets.
GitHub integration is explicitly described as a direct path — teams can connect existing repositories without rebuilding ingestion from scratch. The tool is positioned for security researchers, bug bounty hunters, and developers running code audits, with Codex and Claude Code named as the supported model backends on the vendor’s documentation.