open·kritt

https://docs.kritt.ai
Admin
open·kritt is an open-source, AI-driven security research platform designed to break security work...
Tokens:10,298
Snippets:169
Trust Score:4.8
Update:2 months ago
Show doc for...
Tokens:
Raw
### Open the CLI

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Initializes the command-line interface to begin the setup process.

```bash
./kritt
```

--------------------------------

### Bootstrap Claude Subscription Environment

Source: https://docs.kritt.ai/ai-provider-setup/claude-code

Initializes the environment variables and starts the Docker stack for a first-time Claude subscription login setup.

```bash
cp .env.example .env  

docker compose up --build  
```

--------------------------------

### Initialize open·kritt setup

Source: https://docs.kritt.ai/ai-provider-setup/overview

Run this command from the repository root to begin the configuration process.

```bash
./kritt setup
```

--------------------------------

### Start the open·kritt stack

Source: https://docs.kritt.ai/ai-provider-setup/openrouter

Command to initialize the stack after configuring the OpenRouter API key.

```bash
./kritt start
```

--------------------------------

### Start or Recreate the Stack

Source: https://docs.kritt.ai/ai-provider-setup/claude-code

Starts the application stack after configuring the Anthropic API key. Stop any existing attached stack with Ctrl+C before running this command to ensure environment changes are applied.

```bash
./kritt start  
```

--------------------------------

### Install Node.js 22.x on Ubuntu/Debian

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Use the NodeSource repository to install Node.js 22.x on Debian-based distributions.

```bash
sudo apt-get update

sudo apt-get install -y ca-certificates curl

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -

sudo apt-get install -y nodejs

node --version
```

--------------------------------

### Define target and dependencies

Source: https://docs.kritt.ai/scans/dependencies

Example configuration showing a remote target, a remote dependency with a specific version, and a local dependency snapshot.

```text
target:        acme/api           @ HEAD  

dependency 1:  acme/shared-auth   @ v2.3.1  

dependency 2:  db-client          (local snapshot from ./local_repos/db-client)  
```

--------------------------------

### Example Prompt with Extra Variables

Source: https://docs.kritt.ai/scans/reserved-extra

A template demonstrating how to reference extra variables within a prompt string.

```text

You are {{extra.actor}} trying to {{extra.goal}}.  

Your permissions are "{{extra.permissions}}".  



```

--------------------------------

### Prompt variable syntax examples

Source: https://docs.kritt.ai/workflows/prompt-variables

Demonstrates the double-brace syntax for referencing built-in variables, commit hashes, and nested extra fields.

```text
{{repo_full}}  

{{ commit_sha }}  

{{extra.tenant_id}}  
```

--------------------------------

### Check Node.js version

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Verify the installed Node.js version before running the CLI.

```bash
node --version
```

--------------------------------

### Define Reserved Output Keys in Post-Script

Source: https://docs.kritt.ai/post-scripts/reserved-post-scripts

Example structure for a post-script output that includes severity, a full report, and a proof of concept.

```text
For "{{summary}}" ({{vulnerability_type}}) at {{file_path}}:{{line}}, produce:  

  

Return:  

- severity (string): CRITICAL, HIGH, MEDIUM, LOW  

- _reserved_report (string): a full Markdown report  

- _reserved_poc (string): Markdown with reproducible exploit steps
```

--------------------------------

### Install Node.js 20 on Rocky Linux

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Enable the Node.js 20 AppStream module on Rocky Linux 9.

```bash
sudo dnf module reset -y nodejs

sudo dnf module enable -y nodejs:20

sudo dnf install -y nodejs

node --version
```

--------------------------------

### Example skill content

Source: https://docs.kritt.ai/skills/add-and-use

A template for defining the Markdown instructions an agent follows when a skill is applied.

```markdown

Use this skill when a scan needs focused security-review guidance.  

  

Process:  

- Map reachable attacker input.  

- Trace to sensitive sinks or invariants.  

- Report only concrete, production-reachable vulnerabilities.  



```

--------------------------------

### Populate local repository directory

Source: https://docs.kritt.ai/scans/local-vs-remote

Commands to prepare the local directory structure and verify available repositories via the API.

```bash
mkdir -p ./local_repos  

cp -R /path/to/my-service ./local_repos/my-service  

curl http://127.0.0.1:3002/api/local-repos  
```

--------------------------------

### Clone the repository

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Downloads the source code and navigates into the project directory.

```bash
git clone https://github.com/Kritt-ai/open-kritt && cd open-kritt
```

--------------------------------

### Manual Docker Stack Configuration

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Configure the environment and permissions manually if not using the CLI. Requires setting at least one provider API key in the .env file.

```bash
cp .env.example .env  

chmod 600 .env  

# Set one provider credential in .env: OPENAI_API_KEY, CODEX_API_KEY,  

# ANTHROPIC_API_KEY, or OPENROUTER_API_KEY.  

mkdir -p .data/codex  

chmod 700 .data/codex  

docker compose up --build  
```

--------------------------------

### All at once batching visualization

Source: https://docs.kritt.ai/workflows/batches

Visual representation of the consume-all mode where a single run receives all results as an array.

```text

Depth 0 → emits 20 entrypoints  

Depth 1 (all at once) → runs once  

          sees {{multi_output_depth_0}} = [ ...20 results... ]  


```

--------------------------------

### Fetch Configuration IDs

Source: https://docs.kritt.ai/scans/create

Retrieve necessary IDs for workflows, post-scripts, skills, and rankers before creating a scan.

```bash
curl --fail http://127.0.0.1:3002/api/workflows  

curl --fail http://127.0.0.1:3002/api/post-scripts  

curl --fail http://127.0.0.1:3002/api/agent-skills  

curl --fail http://127.0.0.1:3002/api/severity-rankers
```

--------------------------------

### Create Local Scan

Source: https://docs.kritt.ai/scans/create

Initiate a scan for a local repository folder. Ensure the folder exists in the configured local_repos directory before submission.

```bash
mkdir -p ./local_repos/qa-smoke-target  
# Add the source files to ./local_repos/qa-smoke-target, then:

curl --fail-with-body \  
  -X POST http://127.0.0.1:3002/api/scans \  
  -H 'Content-Type: application/json' \  
  --data-binary @- <<'JSON'  
{
  "workflowId": 1,
  "postScriptId": 1,
  "repo_kind": "local",
  "repo_full": "qa-smoke-target",
  "repo_scope": "full repository",
  "dependencies": [],
  "configuration": {},
  "model": "sonnet",
  "model_provider": "claude",
  "harness": "claude-code",
  "thinking_effort": "medium",
  "severity_ranker": "Rank exploitable findings first.",
  "extra": {}
}
JSON
```

--------------------------------

### Verify Docker access

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Ensure Docker and Docker Compose are correctly configured for the current user.

```bash
docker info >/dev/null

docker compose version
```

--------------------------------

### Seed Demo Data

Source: https://docs.kritt.ai/getting-started/installation-and-setup

Populate the running stack with sample workflows and findings. This operation is idempotent and safe to run on existing data.

```bash
docker compose exec backend npm run seed  
```

--------------------------------

### One at a time batching visualization

Source: https://docs.kritt.ai/workflows/batches

Visual representation of the default behavior where each result triggers a separate agent run.

```text

Depth 0 → emits 20 entrypoints  

Depth 1 → runs 20 times, once per entrypoint  

          each run sees {{entrypoint}}, {{file_path}}, ...  


```

--------------------------------

### Create Remote Scan

Source: https://docs.kritt.ai/scans/create

Initiate a scan for a remote repository using OpenRouter and Claude Code.

```bash
curl --fail-with-body \  
  -X POST http://127.0.0.1:3002/api/scans \  
  -H 'Content-Type: application/json' \  
  --data-binary @- <<'JSON'  
{
  "workflowId": 1,
  "postScriptId": 1,
  "agentSkillIds": [1],
  "repo_kind": "remote",
  "repo_full": "octocat/Hello-World",
  "commit_sha": "7fd1a60b01f91b314f59955a4e4d4e80d8edf11d",
  "repo_scope": "authentication and untrusted input paths",
  "dependencies": [
    {
      "kind": "remote",
      "repo_full": "octocat/Spoon-Knife",
      "commit_sha": "HEAD"
    }
  ],
  "configuration": {
    "repeat_runs": 1,
    "post_script_ids": [1, 2]
  },
  "model": "z-ai/glm-5.2",
  "model_provider": "openrouter",
  "harness": "claude-code",
  "thinking_effort": "low",
  "severity_ranker": "Rank exploitable, remotely reachable findings first.",
  "extra": {}
}
JSON
```

--------------------------------

### Defining Chips with the _chip_ Prefix

Source: https://docs.kritt.ai/post-scripts/chips

Use the _chip_ prefix in post-script output keys to define labels and values for chips. The label is derived from the key name after the prefix.

```text
- _chip_cvss (string): the CVSS score, e.g. "9.1"

- _chip_exploitable (string): "yes" or "no"

- _chip_cwe (string): the CWE id, e.g. "CWE-89"
```

--------------------------------

### Simple grading post-script

Source: https://docs.kritt.ai/first-scan/post-script

A basic prompt template for grading a vulnerability finding using its summary, type, and location.

```text
Grade the finding "{{summary}}" - a {{vulnerability_type}} at {{file_path}}:{{line}}.  

  

Return:  

- severity (string): CRITICAL, HIGH, MEDIUM, or LOW  


```

--------------------------------

### Referencing extra variables in a prompt

Source: https://docs.kritt.ai/workflows/extra-variable

Use sub-keys of the extra object within prompt templates to define dynamic placeholders. Ensure you reference specific sub-keys rather than the bare extra object.

```text

The following repo {{repo_full}} is a CTF challenge.  

The CTF goal is {{extra.goal}}.  

You are {{extra.actor}} with permissions "{{extra.permissions}}".  


```

--------------------------------

### Repair Codex project credential permissions

Source: https://docs.kritt.ai/ai-provider-setup/codex

Use these commands to fix ownership and permissions if the Codex directory or authentication file was incorrectly created by root.

```bash
CODEX_HOME_DIR=.data/codex  

sudo chown -R "$(id -u):$(id -g)" "$CODEX_HOME_DIR"  

chmod 700 "$CODEX_HOME_DIR"  

[ ! -e "$CODEX_HOME_DIR/auth.json" ] || chmod 600 "$CODEX_HOME_DIR/auth.json"  

./kritt setup  
```

--------------------------------

### Define severity ranking rules

Source: https://docs.kritt.ai/severity-ranker/how-to-create

Use a numbered list in Markdown to define priority logic for scan findings.

```markdown
# Ranking rules  

  

1. Unauthenticated remote code execution ranks highest, always.  

2. Authentication or authorization bypasses on sensitive actions rank next.  

3. Information disclosure ranks by the sensitivity of what leaks.  

4. Downgrade anything that needs privileged access or non-default configuration.  

5. Downgrade findings that are only reachable with local access.  


```

--------------------------------

### Define a scan configuration object

Source: https://docs.kritt.ai/scans/configuration

A typical JSON structure used to define scan-wide settings like file limits and feature flags.

```json
{

  "max_files": 4000,

  "include_tests": false

}
```

--------------------------------

### Reference built-in variables in prompts

Source: https://docs.kritt.ai/workflows/built-in-variables

Use double curly braces to reference built-in variables within prompt templates.

```text
Analyze {{repo_full}} at commit {{commit_sha}}.

Focus on: {{repo_scope}}.

Declared dependencies: {{dependencies}}.


```

--------------------------------

### POST /api/scans

Source: https://docs.kritt.ai/scans/create

Queues a new scan operation with the specified configuration, model, and repository details.

```APIDOC
## POST /api/scans

### Description
Queues a new scan operation. The API returns a 422 status code if IDs, required workflow extras, local folders, or provider/harness combinations are invalid.

### Method
POST

### Endpoint
http://127.0.0.1:3002/api/scans

### Parameters
#### Request Body
- **workflowId** (integer) - Required - Existing workflow ID.
- **postScriptId** (integer) - Required - Existing primary post-script ID.
- **agentSkillIds** (array) - Optional - Array of existing numeric skill IDs.
- **repo_kind** (string) - Optional - 'remote' (default) or 'local'.
- **repo_full** (string) - Required - GitHub 'owner/repo' for remote; folder name under '/local_repos' for local.
- **commit_sha** (string) - Optional - Commit, tag, or branch for remote; defaults to 'HEAD'.
- **repo_scope** (string) - Optional - Focus description; defaults to 'full repository'.
- **dependencies** (array) - Optional - Array of { "kind", "repo_full", "commit_sha"? } references.
- **configuration** (object) - Optional - JSON object for additional settings like 'repeat_runs' and 'post_script_ids'.
- **model** (string) - Required - Provider model ID or supported alias.
- **model_provider** (string) - Required - 'codex', 'claude', or 'openrouter'.
- **harness** (string) - Required - 'codex' or 'claude-code'.
- **thinking_effort** (string) - Optional - 'default', 'low', 'medium', 'high', 'xhigh', 'max', or 'ultra'; defaults to 'medium'.
- **severity_ranker** (string) - Required - Non-empty combined Markdown ranking rules.
- **extra** (object) - Required (as per workflow) - Object containing workflow-referenced {{extra.<key>}} values.

### Request Example
{
  "workflowId": 1,
  "postScriptId": 1,
  "repo_kind": "remote",
  "repo_full": "octocat/Hello-World",
  "model": "z-ai/glm-5.2",
  "model_provider": "openrouter",
  "harness": "claude-code",
  "severity_ranker": "Rank findings first.",
  "extra": {}
}
```

--------------------------------

### Define ranking rules in Markdown

Source: https://docs.kritt.ai/first-scan/ranker

Use a numbered list to define the priority order of findings. The model interprets these instructions to triage results.

```markdown
# Ranking rules  

  

1. Anything allowing unauthenticated remote code execution ranks highest.  

2. Auth bypasses on money-moving endpoints rank above read-only info leaks.  

3. Findings that require an already-privileged actor rank lower.  

4. Deprioritize anything that needs local access or non-default configuration.  


```

--------------------------------

### Validate finding exploitability

Source: https://docs.kritt.ai/post-scripts/recommended-usage

Instruct the model to re-examine a finding and return a verdict with reasoning.

```text

Re-check "{{summary}}" ({{vulnerability_type}}) at {{file_path}}:{{line}}.  

Is it exploitable in a default deployment?  

  

Return:  

- verdict (string): CONFIRMED, LIKELY, or FALSE_POSITIVE  

- reasoning (string)  



```
Tokens:
Raw