Cybersecurity toolkits · Rank #36
open-kritt
Grade C: derived only from the two verdicts below. How grades work
Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.
Why this verdict
How we check →- 107 commits in the last 90 days, none in the last 30. receipt ↗
- Latest release v1.4.1, 63 days ago. receipt ↗
- Prisma 5 declared; latest is 7 (2 majors behind). receipt ↗
- On current major: Express, React. receipt ↗
Snapshot: commit 43e1d19 on main, checked 2026-10-19 07:02 UTC. Receipts link to files at this exact commit.
- Two or more breaking releases behind on a core dependency.
Dependency freshness
| Package | Declared | Latest | Status |
|---|---|---|---|
| Prisma @prisma/client | 5.22.0 | 7.10.1 | 2 majors behind |
| Express express | 5.2.1 | 5.3.0 | Current |
| React react | 19.2.8 | 19.3.1 | Current |
Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.
What's in the stack
- Database / ORM
- Prisma
- Testing
- Vitest
Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.
What the README says you get
- AdminActive account switch
use the persisted **Active** switch to choose which accounts may receive new assignments
- AIWorkflow playbooks
chain focused prompts into reusable security research playbooks
- AIParallel agent scans
run them across AI agents in parallel
- AICodex login support
use a Codex login or connect through OpenAI
- APIHeadless CLI
The headless CLI imports portable workflow, post-script, skill, and ranker JSON
- DeployDocker Compose stack
You need Git, Docker with Docker Compose, and Node.js 20 or newer
- OtherZIP result export
package canonical findings, structured data, post-processing output, reports, and proofs of concept in one ZIP archive
- OtherShare-safe manifest
with a share-safe manifest
- OtherPartial exports
stopped or failed scans with findings produce clearly marked partial exports
- OtherCustom severity rankers
apply custom severity rankers, a consistent finding schema
- OtherAutomatic de-duplication
and automatic de-duplication
- OtherLocalhost-only ports
The default ports bind to `127.0.0.1`
- TestingPost-script verification
use post-scripts to validate issues, build proofs of concept
Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote; 1 unverifiable item was discarded. A README claim is the maker's description, not something we tested.
Watch open-kritt
Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.
History
Sep 29, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.
Show as a table
| Date | Maintenance | Dependencies | Commits (90d) |
|---|---|---|---|
| Oct 19, 2026 | Steady | 2+ majors behind | 107 |
| Oct 12, 2026 | Active | 2+ majors behind | 114 |
| Sep 29, 2026 | Active | 2+ majors behind | 114 |
Sources
Every claim on this page comes from these public records, checked . Open them to verify.
- Commit history ↗ default branch (main) at the checked commit: pulse, contributors, last commit
- Releases ↗ latest release
- frontend/package.json ↗ declared dependency versions and stack (at commit 43e1d19)
- backend/package.json ↗ declared dependency versions and stack (at commit 43e1d19)
- README ↗ quoted features at the checked commit
- npm registry ↗ latest versions (each linked in the table above)
Maintainer? Add the badge
It updates automatically every time we refresh the evidence. Clicking it opens this page.
[](https://kitproof.dev/kits/open-kritt/)