deepsec vs open-kritt
deepsec is much bigger: 7.9k stars against 2.1k. Over the days we have tracked them deepsec moved +150.9% and open-kritt +25.7%, so deepsec is growing faster right now.
open-kritt leads on model freedom. deepsec does not take any axis by a clear margin.
Stars and commit dates come from our own daily tracking. The six axes are read off each project's documentation by our review pipeline, so they describe what a project says about itself, not what we measured in its code.
Where they stand today
Agent-powered whole-repo vulnerability scanner that scales across workers, resumes interrupted runs, and lets you grow project-specific matchers.
- Stars
- 7.9k
- Tracked growth
- +150.9%
- Maturity
- ●●●●●
- Last commit
- 4d ago
- Language
- TypeScript
- License
- Apache-2.0
- Cost to run
- Uses your model API keys; full-repo scans can be costly for large repos
Orchestrates focused AI agent workflows in disposable job containers to find, validate and de-duplicate real vulnerabilities with PoC generation and ranking.
- Stars
- 2.1k
- Tracked growth
- +25.7%
- Maturity
- ●●●●●
- Last commit
- 15h ago
- Language
- JavaScript
- License
- AGPL-3.0
- Cost to run
- Requires model API key (your provider's billing applies).
Six axes, head to head
Each axis runs 0 to 5. The label under a score is what that project's own docs claim, not a category average.
| Axis | deepsec | open-kritt |
|---|---|---|
Context depth How much of your codebase it sees before it answers: the open diff, the diff plus related files, or the whole repository. | ●●●●● Whole-repo analysis | ●●●●● Whole-repo analysis |
Noise control How it keeps output volume down — severity thresholds, deduplication, incremental runs over new commits only. | ●●●●● Revalidate + matchers | ●●●●● Deduplication & ranking |
Customization How far it bends to your team: custom rules, prompts, style guides, per-path config. | ●●●●● Plugins & matchers | ●●●●● Workflow & rules |
Privacy Whether your code stays on your own infrastructure: fully local, self-hostable, or cloud API only. | ●●●●● Cloud APIs with key | ●●●●● Self-hosted (cloud models) |
Model freedom Whether you can point it at any provider, or it is wired to one. | ●●●●● BYOK & providers | ●●●●● Bring-your-key (multiple) |
Setup ease What it takes to get a first useful run out of it. | ●●●●● Config + API key | ●●●●● Docker + CLI setup |
Which one to pick
Pick deepsec if…
High-coverage — pick deepsec when you need an agent-driven, tunable scanner that analyzes entire large codebases and supports custom matchers and distributed execution.
Pick open-kritt if…
Self-hosted — run customizable, security-focused AI research workflows locally with built-in validation, de-duplication and BYO model access.
- Model freedom: Bring-your-key (multiple) (5/5 against 3/5)
What people want from each one
vercel-labs/deepsec
Kritt-ai/open-kritt
Questions people ask
Is deepsec better than open-kritt?
open-kritt leads on model freedom. deepsec does not take any axis by a clear margin. deepsec is worth picking when high-coverage — pick deepsec when you need an agent-driven, tunable scanner that analyzes entire large codebases and supports custom matchers and distributed execution.
Which of deepsec and open-kritt keeps my code private?
deepsec: Cloud APIs with key (3/5). open-kritt: Self-hosted (cloud models) (4/5).
What does each one cost to run?
deepsec: Uses your model API keys; full-repo scans can be costly for large repos. open-kritt: Requires model API key (your provider's billing applies)..
Full profiles: vercel-labs/deepsec and Kritt-ai/open-kritt. Everything else in Code review agents.