Big repositories, small questions: Open Kritt is a self-hosted platform that splits vulnerability research into focused tasks for AI agents and returns ranked, de-duplicated findings. Build a workflow as a tree of prompt steps, where each step declares the structured output it must produce and the next level launches one fresh agent per result. Scan remote or local repositories along with their dependencies, using Codex, Claude Code, or Grok Build as the harness. Every workflow ends in one fixed finding schema covering file, line, vulnerability type, trigger flow, and a malicious input example. Post-scripts then validate each finding, build a proof of concept, or write the report. Markdown severity rankers tell the model how to prioritize for your bounty program, and repeated findings collapse automatically. Model access comes from a Codex login or OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI keys, with an Active switch to choose which accounts take new work. A dashboard tracks blueprints, scans, and findings, a headless command-line tool imports workflows and launches scans on servers without a browser, and finished scans export as one ZIP with a share-safe manifest. Built-in workflows, including an entry-point-driven hunt, give you a starting point. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Your AI coding agent has your API keys in its environment and unrestricted network access, which means one prompt injection away from sending those secrets anywhere. Pipelock closes that gap by sitting as a proxy between your agents and every outbound connection, scanning the actual content of HTTP, WebSocket, MCP, and Agent-to-Agent traffic before it leaves your server. An 11-layer scanner pipeline checks every request against 62 credential patterns covering AWS, GCP, Azure, GitHub, OpenAI, Anthropic, SSH keys, and database URLs, then inspects every response for prompt injection using 29 detection patterns with six-pass normalization that catches base64-encoded, leetspeak, and whitespace-obfuscated payloads. The MCP proxy wraps any Model Context Protocol server (stdio, HTTP, or WebSocket) with bidirectional scanning that detects tool description poisoning and mid-session rug-pull changes via SHA-256 fingerprinting. Every scanning decision produces a cryptographically signed action receipt that third parties can verify offline without trusting the agent or the vendor. The Operator Console provides a web dashboard for reviewing evidence scorecards, receipt timelines, agent sessions, enforcement decisions, and fleet posture at a glance. Cross-request taint tracking catches slow-drip exfiltration attempts that spread a secret across multiple calls. Canary tokens plant synthetic secrets that trip alerts the moment an agent tries to exfiltrate them. Pre-built Prometheus metrics and a Grafana dashboard provide real-time visibility into traffic volumes and block rates. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Trusted by over seven million developers worldwide with 310+ contributors and more than 10,600 GitHub stars since 2011, SonarQube has become the industry standard for automated code review and continuous code quality inspection. The platform performs deep static analysis across Java, JavaScript, TypeScript, Python, C#, C++, PHP, Kotlin, Go, Ruby, Swift, and 30+ additional languages, detecting bugs that cause runtime failures, security vulnerabilities exploitable by attackers, security hotspots requiring manual review, code smells degrading maintainability, and code duplications increasing technical debt. Quality Gates define pass-fail thresholds on metrics like coverage, duplications, reliability rating, and security rating, failing CI/CD pipelines when new code introduces issues below organizational standards. Pull request analysis decorates GitHub, GitLab, Bitbucket, and Azure DevOps merge requests with inline issue annotations and overall quality summaries before merging. Built-in quality profiles provide curated rule sets per language following the Sonar Way methodology, with dedicated profiles for AI-generated code that target patterns commonly introduced by agentic coding workflows. Infrastructure-as-Code analysis covers Terraform, Kubernetes, Docker, Ansible, CloudFormation, and Helm charts with supply-chain security rules for CI/CD pipelines. The companion IDE plugin delivers real-time analysis with quick-fix guidance directly in VS Code, IntelliJ, and Eclipse. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. LGPL-3.0 licensed.

Autonomous red team execution without manual script coordination is what PentaGI delivers through a multi-agent penetration testing platform engineered for automated security assessments. Security engineers configure testing scopes, target IP ranges, domain lists, and rules of engagement through an interactive web console with real-time execution graphs. Autonomous agent personas break down high-level assessment goals into discrete tactical phases, orchestrating network port discovery, service banner fingerprinting, web application crawling, and CVE verification. Specialized agents query integrated Graphiti knowledge graphs and local vulnerability repositories to synthesize attack paths, validate exploitability, and confirm finding veracity before issuing alerts. Operators monitor live agent terminal streams, inspect sandboxed tool executions, and adjust active LLM provider routes across OpenAI, Anthropic, or local Ollama endpoints. The template editor allows red teams to compose reusable testing playbooks with customizable security prompt chains, safety constraints, and automated remediation reporting. Audit logs capture full command histories, raw tool outputs, and LLM reasoning steps to generate compliance-ready technical documentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.