An AI security engineer on every repo and PR.
AgentGG has found hundreds of zero-day vulnerabilities in open source projects. Every scan runs on our open source CLI: the harness, the agents, and the methodology are public and reproducible. It can also learn from you: our processing layer turns your security history and product context into custom agents, so the bugs you have shipped once never ship again.
Hundreds of zero-days.
Disclosed in the open.
AgentGG agents have found hundreds of previously unknown security bugs in widely used open source projects. Every finding is reported to the maintainers privately and published once a fix ships, with CVEs assigned along the way.
See all advisoriesGeneric scanners
find generic bugs.
Off the shelf SAST covers the same handful of CWE patterns for everyone. The bugs that actually hurt you are specific to your product, your framework, and your org. Those are the ones AgentGG is built to find.
A rule pattern-matches. An agent investigates.
Traditional SAST matches text patterns and floods you with false positives. AgentGG agents read the surrounding code, follow imports, and confirm a problem is real before they flag it.
Your incidents become detectors.
Your past security reports, pentest findings, and product context feed our processing layer, which builds and validates agents from them. From then on, every change is scanned for every bug class you have shipped.
See exactly what scans your code.
Most AI scanners keep their agents and methods secret. Ours are readable markdown, reviewed and versioned like code, next to your code. You always know exactly what ran and why it flagged what it did.
Connect. Scan. Triage.
The platform runs AgentGG for you, with nothing to host and no keys to manage. Pricing is on demand and competitive.
Connect your repos
Install the GitHub App and pick your repos. You can also scan a ZIP or a git URL directly.
Every PR gets scanned
Scans run automatically on every pull request. Findings come back as a GitHub check with inline comments on the exact lines, before merge. Full-repo scans run on demand for a baseline.
Triage in one dashboard
Findings are validated, CVSS-scored, and deduplicated before you see them. The whole team works from one place, with roles, workspaces, and filters by severity, verdict, or agent.
The engine is free and open.
The same scanner that powers the platform is an Apache 2.0 CLI with over 100 open source agents. Run it on your own machine, on your own keys, against any codebase. If you find it useful, star it and contribute an agent.
Multi-provider: Anthropic, OpenAI, OpenRouter, Bedrock, Vertex AI, Ollama.
Common questions.
What exactly is an agent?+
A readable markdown file that briefs an AI investigator: what bug class to hunt, where to look, and what counts as proof. At scan time the agent reads files, follows imports, and walks the call graph before it flags anything. Agents are reviewed and versioned like code.
How is this different from traditional SAST?+
Traditional SAST matches text patterns and floods you with false positives it cannot verify. AgentGG agents read the surrounding code and confirm a problem is real before flagging it, and every finding then goes through a second validation pass that assigns a CVSS severity. The proof is on our advisories page: hundreds of zero-days in real open source projects, with CVEs assigned.
What are custom agents?+
A guided service for any team, from open source projects to enterprises. Our processing layer builds and validates agents from your past security issues, pentest findings, and product context, until the bug classes you have shipped before are covered. The agents then run on every change across every repo. Book a demo to talk through it.
Can I run it myself?+
Yes. The engine is an Apache 2.0 CLI: npm install -g agentgg. Bring your own model keys (Anthropic, OpenAI, OpenRouter, Bedrock, Vertex AI) or run fully local with Ollama. The 100+ agent catalog is open source too.
What does it cost?+
The CLI is free. Platform pricing is on demand and competitive: we run inference at volume with negotiated rates and optimize heavily across scans, and those savings are passed on. Book a demo and we will price it for your team on the call.