open-kritt: a Chinese translation of the self-hosted AI vulnerability research tool

open-kritt: a Chinese translation of the self-hosted AI vulnerability research platform The original Kritt-ai/open-kritt repository has 2284 stars and is written in JavaScript. It is an open-source, self-hosted platform for AI-driven security and vulnerability research. The project's own one-line description is: "Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code." A Chinese translation of that project now exists at yangshun2005/open-kritt-cn. It was published on 2026-10-14. The Chinese version is new and currently has no stars of its own; the 2284 figure belongs to the original project only. This article covers what the tool does, why the Chinese documentation matters, and how to get it running. Everything below is drawn from the translated README and the original project's documentation. Point a language model at an entire repository and ask it to find vulnerabilities, and the results are usually poor. The signal-to-noise ratio is bad, findings are hard to verify, and there is no consistent way to rank them. open-kritt takes a different approach. Instead of one large prompt against a whole codebase, it breaks research into small, explicit tasks. Multiple AI agents execute those tasks in parallel. Their outputs are then merged into findings that are deduplicated, ranked, and verifiable. The project is aimed at security researchers and security-conscious developers. The stated goal is to let users control their own prompts, workflows, model providers, and infrastructure. From the README, the core capabilities are: Build workflows — chain focused prompts into reusable security research playbooks. Run scans — analyze remote or local repositories and their dependencies using Codex, Claude Code, or Grok Build. Validate findings — use post-scripts to verify issues, build proof-of-concepts, and generate reports. Export scan results — package normalized findings, structured data, post-processing output, reports, and PoCs into a single ZIP archive with a shareable manifest. Completed scans produce a full export; stopped or failed scans that still contain findings produce a clearly marked partial export. Reports and PoC source influenced by an attacker are preserved as plain text. Rank results — apply custom severity rankers, a unified finding schema, and automatic deduplication. Bring your own model access — use Codex login, or connect via OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI. The project states it comes out of real security research. The Kritt team, under the researcher name Blockian, reports earning over $1,500,000 in bug bounties (linked profiles on Immunefi, HackenProof, blockian.xyz, and @Kritt_AI on X). open-kritt is described as the open-source distillation of the internal tooling behind that work. The original documentation is in English. For Chinese-speaking developers, that is a real barrier — not because the concepts are impossible to follow, but because setup instructions, threat-model notes, and configuration details are exactly the kind of text where a misread line costs an hour. The Chinese version is not just a machine-translated dump. It has two layers: A Chinese quick-start guide at the top, explicitly marked as supplementary material and not part of the original README. Its stated purpose is to let you get the project running without reading the whole document. A full Chinese translation of the original README body, which the page says aims to stay faithful to the source. The translation page also invites issues or pull requests for inaccuracies. That is a reasonable posture for a translated technical document, since terminology choices ("finding", "post-script", "severity ranker") are not always obvious. The practical value is straightforward: a Chinese-speaking developer can read the quick-start, understand the prerequisites and the security warnings, and get the stack running, without first parsing an English document about a security tool where precision matters. Prerequisites: Git, Docker with Docker Compose, and Node.js 20 or newer. The repository ships its own CLI, so there is no installation step. Clone and enter the directory: git clone https://github.com/Kritt-ai/open-kritt cd open-kritt Run setup, which walks you through available login methods and API key configuration: ./kritt setup Start the stack: ./kritt start Then open http://localhost:5173 in a browser. On a server without a browser or desktop, keep the stack running and open another shell: ./kritt-headless The translated README is explicit about some requirements and silent about others. Being precise here matters: Operating system: the original does not specify supported systems. It only notes the stack can run on a server without a browser or desktop. Hardware: not specified in the original. Dependencies: Git, Docker (with Docker Compose), Node.js 20 or newer. Version requirements: Node.js 20+; other dependency versions are not stated in the original. Model access: at least one method is required — Codex login, or a connection via OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI. Network: the translation adds a general note that in mainland China network environments, downloading Docker images or npm dependencies may require switching to a mirror or accelerated source. This is flagged as a general tip and not part of the original text. The translated quick-start calls out several issues that are easy to miss and expensive to get wrong. No application-layer authentication by default. The default port binds to 127.0.0.1, and the backend does not include application authentication. The stack must stay private. Do not expose it. Agents run as root. Agents with tools enabled run as root inside one-shot job containers. They have a writable copy of the repository and direct internet access, which is needed to install tools, compile targets, run tests, and build PoCs. Before scanning untrusted code, run on a dedicated Docker host or VM, and read the threat model documentation first. Model credentials are mandatory. You must configure at least one model access method, either login or API key. ./kritt setup guides you through it. GITHUB_TOKEN is optional and only needed for accessing private GitHub repositories. The headless CLI has limits. ./kritt-headless does not display the content of vulnerability findings in the terminal. It shows scan status, phases, and failure reasons only. The Chinese translation covers the README and adds a practical quick-start. It does not change the software. The AGPL-3.0 license, the JavaScript codebase, and the 2284 stars all belong to the original project at Kritt-ai/open-kritt. If you are a Chinese-speaking security researcher or developer who has been putting off trying open-kritt because of the English docs, the translation removes that specific excuse. The setup path is short: clone, ./kritt setup, ./kritt start. The security warnings are the part worth reading carefully before you point it at anything you do not trust. Chinese documentation: https://github.com/yangshun2005/open-kritt-cn I'm an independent enterprise AI delivery consultant — private LLM deployment, RAG, agent workflows, AIOps. If your team is stuck somewhere in that stack, my inbox is open.