open-kritt: a Chinese translation of the self-hosted AI vulnerability research tool

A Chinese translation of that project now exists at yangshun2005/open-kritt-cn. It was published on 2026-10-14. The Chinese version is new and currently has no stars of its own; the 2284 figure belongs to the original project only.

This article covers what the tool does, why the Chinese documentation matters, and how to get it running. Everything below is drawn from the translated README and the original project's documentation.

Point a language model at an entire repository and ask it to find vulnerabilities, and the results are usually poor. The signal-to-noise ratio is bad, findings are hard to verify, and there is no consistent way to rank them.

open-kritt takes a different approach. Instead of one large prompt against a whole codebase, it breaks research into small, explicit tasks. Multiple AI agents execute those tasks in parallel. Their outputs are then merged into findings that are deduplicated, ranked, and verifiable.

The project is aimed at security researchers and security-conscious developers. The stated goal is to let users control their own prompts, workflows, model providers, and infrastructure.

From the README, the core capabilities are:

The project states it comes out of real security research. The Kritt team, under the researcher name Blockian, reports earning over $1,500,000 in bug bounties (linked profiles on Immunefi, HackenProof, blockian.xyz, and @Kritt_AI on X). open-kritt is described as the open-source distillation of the internal tooling behind that work.

The original documentation is in English. For Chinese-speaking developers, that is a real barrier — not because the concepts are impossible to follow, but because setup instructions, threat-model notes, and configuration details are exactly the kind of text where a misread line costs an hour.

The Chinese version is not just a machine-translated dump. It has two layers:

The translation page also invites issues or pull requests for inaccuracies. That is a reasonable posture for a translated technical document, since terminology choices ("finding", "post-script", "severity ranker") are not always obvious.

The practical value is straightforward: a Chinese-speaking developer can read the quick-start, understand the prerequisites and the security warnings, and get the stack running, without first parsing an English document about a security tool where precision matters.

Prerequisites: Git, Docker with Docker Compose, and Node.js 20 or newer. The repository ships its own CLI, so there is no installation step.

git clone https://github.com/Kritt-ai/open-kritt cd open-kritt Enter fullscreen mode Exit fullscreen mode Run setup, which walks you through available login methods and API key configuration:

./kritt setup Enter fullscreen mode Exit fullscreen mode Start the stack:

./kritt start Enter fullscreen mode Exit fullscreen mode Then open http://localhost:5173 in a browser.

On a server without a browser or desktop, keep the stack running and open another shell:

./kritt-headless Enter fullscreen mode Exit fullscreen mode Environment requirements The translated README is explicit about some requirements and silent about others. Being precise here matters:

The translated quick-start calls out several issues that are easy to miss and expensive to get wrong.

No application-layer authentication by default. The default port binds to 127.0.0.1, and the backend does not include application authentication. The stack must stay private. Do not expose it.

Agents run as root. Agents with tools enabled run as root inside one-shot job containers. They have a writable copy of the repository and direct internet access, which is needed to install tools, compile targets, run tests, and build PoCs. Before scanning untrusted code, run on a dedicated Docker host or VM, and read the threat model documentation first.

Model credentials are mandatory. You must configure at least one model access method, either login or API key../kritt setup guides you through it. GITHUB_TOKEN is optional and only needed for accessing private GitHub repositories.

The headless CLI has limits../kritt-headless does not display the content of vulnerability findings in the terminal. It shows scan status, phases, and failure reasons only.

If you are a Chinese-speaking security researcher or developer who has been putting off trying open-kritt because of the English docs, the translation removes that specific excuse. The setup path is short: clone,./kritt setup,./kritt start. The security warnings are the part worth reading carefully before you point it at anything you do not trust.

Chinese documentation: https://github.com/yangshun2005/open-kritt-cn

I'm an independent enterprise AI delivery consultant — private LLM deployment, RAG, agent workflows, AIOps. If your team is stuck somewhere in that stack, my inbox is open.