Attributed metadata history

open-kritt: a Chinese translation of the self-hosted AI vulnerability research tool

open-kritt: a Chinese translation of the self-hosted AI vulnerability research platform The original Kritt-ai/open-kritt repository has 2284 stars and is written in JavaScript. It is an open-source, self-hosted platform for AI-driven security and vulnerability research. The project's own one-line description is: "Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code." A Chinese translation of that project now exists at yangshun2005/open-kritt-cn. It was published on 2026-10-14. The Chinese version is new and currently has no stars of its own; the 2284 figure belongs to the original project only. This article covers what the tool does, why the Chinese documentation matters, and how to get it running. Everything below is drawn from the translated README and the original project's documentation. The problem open-kritt is trying to solve Point a language model at an entire repository and ask it to find vulnerabilities, and the results are usually poor. The signal-to-noise ratio is bad, findings are hard to verify, and there is no consistent way to rank them. open-kritt takes a different approach. Instead of one large prompt against a whole codebase, it breaks research into small, explicit tasks. Multiple AI agents execute those tasks in parallel. Their outputs are then merged into findings that are deduplicated, ranked, and verifiable. The project is aimed at security researchers and security-conscious developers. The stated goal is to let users control their own prompts, workflows, model providers, and infrastructure. What the platform actually does From the README, the core capabilities are: Build workflows — chain focused prompts into reusable security research playbooks. Run scans — analyze remote or local repositories and their dependencies using Codex, Claude Code, or Grok Build. Validate findings — use post-scripts to verify issues, build proof-of-concepts, and generate reports. Export scan results — package normalized findings, structured data, post-processing output, reports, and PoCs into a single ZIP archive with a shareable manifest. Completed scans produce a full export; stopped or failed scans that still contain findings produce a clearly marked partial export. Reports and PoC source influenced by an attacker are preserved as plain text. Rank results — apply custom severity rankers, a unified finding schema, and automatic deduplication. Bring your own model access — use Codex login, or connect via OpenAI, Anthropic, DeepSeek, OpenRouter, or xAI. The project states it comes out of real security research. The Kritt team, under the researcher name Blockian, reports earning over $1,500,000 in bug bounties (linked profiles on Immunefi, HackenProof, blockian.xyz, and @Kritt_AI on X). open-kritt is described as the open-source distillation of the internal tooling behind that work. Why a Chinese translation is useful here The original documentation is in English. For Chinese-speaking developers, that is a real barrier — not because the concepts are impossible to follow, but because setup instructions, threat-model notes, and configuration details are exactly the kind of text where a misread line costs an hour. The Chinese version is not just a machine-translated dump. It has two layers: A Chinese quick-start guide at the top, explicitly marked as supplementary material and not part of the original README. Its stated purpose is to let you get the project running without reading the whole document. A full Chinese translation of the original README body, which the page says aims to stay faithful to the source. The translation page also invites issues or pull requests for inaccuracies. That is a reasonable posture for a translated technical document, since terminology choices ("finding", "post-script", "severity ranker") are not always obvious. The practical value is straightforward: a

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.