Sign inCreate account
Sign inCreate account

agentgg

From public sources

Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.

AI toolCategory: AI ToolsOpen sourcedata checked Oct 16, 2026
Add to compareAdd to collection

Overview

  • ai-agents
  • ai-hacking
  • ai-penetration-testing
  • appsec
  • cli
  • code-quality
  • code-review
  • cybersecurity
  • cybersecurity-tools
  • ethical-hacking
  • llm
  • llm-security

Installation

Commands are shown, never run by the marketplace. Check them against the official documentation.

Compatibility

Unknown means no evidence was found — not that the product is incompatible.
PlatformStatusArchitectureEvidenceConfidence
WindowsUnknown———
macOSUnknown———
LinuxUnknown———
Web browserUnknown———
Server / self-hostedUnknown———
Container (OCI)Unknown———

Releases

checked Oct 30, 2026
No releases found on the source.

Quality profile

algorithm quality-v1.0 · assessed Oct 16, 2026
Quality Score78
Risk Score0
Confidence 1.00
Quality Score and Risk Score are different measures. A high score does not guarantee safety.

Score components

Maintenance · 2020
last activity 1 days ago
Documentation · 1515
README 4690 chars, description present
Ready to use · 159
install instructions: yes; releases: no
Metadata · 1010
4/4 of description, homepage, license, topics
Releases · 102
0 release(s)
Category confidence · 105
classifier confidence 0.5
Adoption · 107
443 stars (log-dampened, 10k = max)
License clarity · 55
SPDX Apache-2.0
Community · 55
issues enabled, 51 forks

License

Apache-2.0
Known licensefrom the repository host

This is the catalog policy status, not legal advice.

Sources

github.com/agentgg-dev/agentggPrimary★ 443 starslast activity Oct 15, 2026Primary repository · Confidence 1.00

Reviews

Sign in to write a review

No reviews yet.

Alternatives

numasecSimilar
The AI Agent for Cyber Security.AGPL-3.0 · AI Tools
critSimilar
Review AI coding agents' plans, diffs and running apps in the browser. Local-first, works with any agent.MIT · AI Tools
agentsealSimilar
Security toolkit for AI agents. Scan your machine for dangerous skills and MCP configs, monitor for supply chain attacks, test prompt injection resistance, and audit live MCP servers for tool poisoning.AI Tools
EVASimilar
EVA is an AI-assisted penetration testing agent that enhances offensive security workflows by providing structured attack guidance, contextual analysis, and multi-backend AI integration.AI Tools
gptmeSimilar
Your agent in your terminal, equipped with local tools: writes code, uses the terminal, browses the web. Make your own persistent autonomous agent on top!MIT · AI Tools
LAPSimilar
Your agents are guessing at APIs. Give them the actual Agent-Native spec. 1500+ API's Ready To-Use skills, Compile any API spec into a lean, agent-native format. 10× smaller. OpenAPI, GraphQL, AsyncAPI, Protobuf, Postman.Apache-2.0 · AI Tools

README

From agentgg-dev/agentgg · license Apache-2.0 · fetched Oct 30, 2026

agentgg

Agentic SAST. White box. CI ready.

agentgg is an agentic SAST scanner. Its agents read your code and reason about it — they follow imports, check the call graph, and confirm a finding before they report it, instead of pattern-matching the way traditional SAST does. Run it over a whole repository, or over a git diff for pull request review. Every scan opens with a fast recon pass that briefs the agents on what the project is, and an interrupted scan resumes on re-run.

Documentation · agentgg.dev · Platform · Agents catalog · Report a bug · Report a security issue

Help us grow and star us on GitHub! ⭐️

agentgg is in beta. Things will move and edges will be rough. Bug reports and feedback are very welcome. Open an issue.

Install

Don't want to run it locally? app.agentgg.dev runs the same scanner as a hosted service: upload a repo, no install, no provider key of your own.

npm install -g agentgg

Requires Node.js 20+. You also need an account with one model provider — Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, or a local Ollama. See Providers for setup, and CONTRIBUTING.md to build from source.

Live validation (--live-validate) also needs Docker. If Docker is missing or stopped, agentgg offers to install or start it when the command begins.

Quick start

agentgg init                                            # one-time: pick a provider, paste a key
agentgg scan ./src -o ./out                             # scan everything
agentgg scan ./src --diff origin/main...HEAD -o ./out   # PR-style: scan only what changed
agentgg status ./out                                    # what got found and validated
agentgg view ./out                                      # browse findings in a local web UI

A scan writes summary.md and one markdown file per finding into ./out/, plus a state/ directory that makes resume, status, and revalidate work. Re-run with the same -o and unchanged files are skipped; a different -o starts fresh.

Walkthrough: Quickstart.

Documentation

Browse the full documentation at docs.agentgg.dev.

Agents

An agent is one markdown file: YAML frontmatter that declares where to look and an optional precondition that decides whether the agent is worth running on this repo, plus a markdown body that is the prompt. An agent that declares neither extensions nor filePatterns in its where has no file scope: it gets no pre-selected files and searches the whole repository with its own tools instead. The catalog auto-downloads on first scan from agentgg-dev/agentgg-agents, and agentgg create turns a past incident report into a reusable agent.

Write your own: Agent anatomy · Targeting · Create from reports

Contributing

Bug reports, agents, and pull requests are all welcome. See CONTRIBUTING.md for the dev workflow, CODE_OF_CONDUCT.md for community expectations, and SECURITY.md to report a vulnerability privately.

License

agentgg is licensed under the Apache License, Version 2.0. See LICENSE for the full text and NOTICE for attribution.

Open the repository ↗