Launched this week
kritt.ai
Open-source infrastructure for AI-based security research
11 followers
Open-source infrastructure for AI-based security research
11 followers
Open Kritt is an open-source platform for building AI-powered security research workflows. Orchestrate LLMs, tools, and custom agents into reusable pipelines for vulnerability research, code analysis, and automation. Used internally to discover more than 60 High & Critical security vulnerabilities, Open Kritt is now available for the community to build, extend, and share workflows.
One thing that would make this way more useful for me is a built-in workflow debugger that shows step-by-step which tool call or agent decision actually led to a finding. When a pipeline surfaces a vulnerability, I want to trace the reasoning chain, replay individual nodes, and see token usage per step. Right now I have to reconstruct that manually from logs, which gets painful on multi-stage research flows. A visual trace view would turn this from a black box into something I can actually trust and iterate on.
@sibel119291 That's a great point! We already have the Executor Viewer available on port 8090, but I don't think we call it out clearly enough in the documentation. We'll make sure to improve that. Thanks for pointing it out! 🙌
kritt.ai
Really like the open-source direction here. Curious—what kind of security research workflow made you realize existing AI tooling wasn't enough?
@aryan787544 Doing bug bounties.
Most existing AI tools work well when you're analyzing a closed-source codebase that only your team has access to. But bug bounty targets, specifically the open source ones, makes things much harder. Everyone has access to the same code and the same AI models, so the obvious, low-hanging fruit gets found very quickly.
We needed a different approach - one that goes beyond simple prompting and enables more structured, iterative workflows capable of uncovering deeper, more complex vulnerabilities :)
@gabi_controlz Really enjoyed your explanation. The shift from "better prompts" to structured security research workflows feels like a much bigger positioning advantage than just another AI security tool.
I had a couple of thoughts on where that narrative could become even stronger as the space matures. If you're open to it, what's the best email to send them to?
Plugged in my own LLM config and a static analysis tool, kicked off a vulnerability research pipeline, and it actually surfaced a legit issue I had missed. The reusable workflow setup feels really practical.
@ravzakemerci That's amazing! Glad to hear it could help :)