Kritt: AI-Powered Vulnerability Discovery and Verification

Research Context and Background

Kritt is an open-source security engine designed to find security flaws that often get missed during standard code reviews. It uses artificial intelligence agents to analyze codebases in parallel and turns their findings into a ranked list of verified issues. The system was built using the same workflows that Kritt's internal security research team uses for public bug-bounty hunting. This means the tool is grounded in real-world security practices rather than just theoretical concepts.

Benefits

Kritt offers several key advantages for organizations looking to secure their software. First, it maps the attack surface by breaking a large codebase into smaller, focused security tasks. This ensures the analysis is granular and targeted instead of broad and superficial. Second, it runs AI agents in parallel to cover the entire codebase efficiently. This parallel processing allows for comprehensive coverage without slowing down the process. Third, Kritt includes a verification loop. After the AI agents generate potential findings, the system runs post-scripts to validate if the issues are real. It builds Proof of Concept code or drafts reports to ensure the findings are not just theoretical. Finally, Kritt ranks and de-duplicates findings based on user-defined impact criteria. This results in a concise list of high-confidence issues, such as identifying a specific state transition flaw with a high confidence score.

Use Cases

Kritt is ideal for teams that need to identify deep-seated security vulnerabilities that traditional methods might miss. Developers and security teams can use the self-hosted version to integrate directly into their workflow. They can choose their preferred AI models and define custom workflows to fit their specific needs. Organizations that prefer not to manage infrastructure can opt for managed research services. This is useful for companies that want a dedicated security team to operate the scan on their behalf. The tool works well for both local and remote repositories and supports various programming languages. It is particularly effective for production code across leading networks where high-confidence security findings are critical.

Pricing

Kritt offers two primary paths for users. The self-hosted version, known as open-kritt, is free and open-source under the AGPL-3.0 license. This allows teams to have full control over the engine, AI models, and severity rules. For organizations that prefer managed services, Kritt offers paid tiers. The Single Scan tier starts at $5,000 and covers up to 200,000 lines of code. This includes a written report of high-impact findings that have been validated. The Teams and Continuous Coverage tier is designed for enterprises needing CI/CD integration and release coverage. This option includes dedicated support, PR and release scanning, and Service Level Agreements. Clients can contact Kritt directly for tailored security research plans.

Vibes

Kritt has a strong track record built from real security work. The system was shaped by the workflows of Kritt's team in public bug-bounty research. This background gives users confidence that the tool can handle complex security challenges. The Blockian record demonstrates its capability to secure production code across leading networks. Users appreciate the conversation-first approach for managed engagements, where clients can discuss their specific security problems before committing to a plan. The focus on verified, high-impact work resonates with security professionals who need actionable results rather than false alarms.

Additional Information

Kritt was built from real security work and shaped by the workflows of Kritt's team in public bug-bounty research. The system is designed to support verified, high-impact work, as evidenced by the Blockian record, demonstrating its capability to secure production code across leading networks. The open-source engine is available on GitHub, allowing the community to contribute and customize the tool. The managed research services are operated by Kritt's security team, ensuring that the scans are conducted by experts with deep industry knowledge.