AgentGGAgentGG
Get started
Beta · open source · Apache 2.0

The open source engine.

The same scanner that powers the platform, free on your own machine and your own keys. Over 100 open source agents that reason about your code: they follow imports, check the call graph, and validate findings before reporting. It found every zero-day on our advisories page.

Star on GitHubView on npm
~/code/my-app · zsh
$
[1/3] recon: surveying the project…
typescript · express · postgres
[2/3] preconditions: 122 selected
84 queued · 38 skipped (not relevant)
[3/3] agents
sql-injection src/login.ts ✓ finding
hardcoded-secrets src/config.ts ✓ finding
missing-access-control src/admin/users.ts ✓ finding
validate → confirmed=3 false-positive=1
score → CRITICAL=1 HIGH=2
report → ./out/summary.md (4 findings, 312 files, 41.2s)
$
Quickstart

From install to first finding, in four commands.

01Install
02Configure
03Scan
04View
What it is

An agent registry, an orchestrator, and a CLI.

A white box scanner that runs on your full repo, or on a git diff for merge requests. Over 100 agents ship out of the box, covering security vulnerabilities, coding anti-patterns, and codebase recon. AgentGG can be integrated into CI/CD pipelines to scan every change automatically. Like Nuclei, AgentGG maintains a repository of open source templates, but instead of regex they are agents.

Diff scans

Only review the files changed in a merge request, so PR feedback stays fast and cheap.

agentgg scan ./src --diff origin/main

Full-repo scans

Run every agent across the whole codebase. Good for a baseline or a nightly job.

agentgg scan ./src -o ./out

Validate and score

A second pass confirms each finding against your scope file and rates it with a CVSS severity. Both run by default; point --scope at your own policy.

agentgg scan ./src --scope ./SECURITY.md

Web UI

Browse findings in a local web UI. Filter by severity, agent, or file.

agentgg view ./scan-results
Write an agent in 30 seconds

Agent file in. GHSA shaped finding out.

One text file in. One markdown report out. Drop it in your agents directory or pass it inline with -t.

my-agents/sql-injection.md
---
slug: sql-injection
name: SQL Injection
description: Untrusted input concatenated into SQL
  instead of parameterized queries.
precondition:
  regex:
    patterns:
      - regex: "(query|execute)\("
where:
  extensions: [ts, js, py]
  preFilter:
    - regex: "(query|execute)\([^)]*\+"
references:
  - CWE-89
---

Flag queries built by concatenation or template
interpolation of untrusted input. Follow query
helpers to confirm before flagging.
out/findings/login-sql.md
# Unsafe SQL in login flow

**Agent:** `sql-injection`
**File:** `src/login.ts:12`
**Verdict:** `confirmed` (CVSS 8.6)

`login()` interpolates `req.body.email` into
a raw SQL string, allowing auth bypass.

### PoC
POST /login
email: ' OR 1=1 --
Documentation

Everything is in the README.

The full reference lives with the code. These jump straight to the section you need.

How a scan runs

Recon, preconditions, agents, validation, scoring, and dedup: the full pipeline.

Agent templates

The agent file format: frontmatter, preconditions, where-clauses, and prompts.

Providers

Anthropic, OpenAI, OpenRouter, Bedrock, Vertex AI, and Ollama. Configure once with agentgg init.

GitHub Actions

Run diff scans on every pull request straight from your workflow file.

Commands

scan, view, init, agents, create: every command and what it does.

Scan flag reference

Every flag on agentgg scan, from --diff to --scope to concurrency.

Providers

Run your own model. Local or hosted.

Every provider runs the whole pipeline: recon, detection, validation, and scoring. Configure once with agentgg init, or pass credentials per scan.

Anthropic
API key or OAuth
OpenAI
API key
OpenRouter
API key, many models
Bedrock
AWS credentials
Vertex AI
GCP, Model Garden
Ollama
local, air-gap friendly
Want this running on every PR without managing keys and compute? See the platform.