Open Source Agentic SAST with Proven Impact
agentgg is an open source agentic Static Application Security Testing (SAST) tool designed to identify zero-day vulnerabilities in codebases. Since its release in 2026, it has been credited with uncovering hundreds of undisclosed zero-day vulnerabilities across widely used open source projects. Unlike traditional SAST tools that rely on pattern-matching, agentgg employs AI-driven agents to analyze code contextually, reducing false positives and improving accuracy. The tool operates under the Apache 2.0 license, ensuring permissive use and modification by the community.
The project is maintained by agentgg-dev and is implemented in TypeScript, making it accessible for integration into existing development workflows. Its primary purpose is to support testing and red teaming efforts, with a focus on automating security assessments for repositories and pull request diffs. The tool’s design emphasizes transparency, reproducibility, and customization, allowing users to bring their own AI models for analysis.
agentgg’s effectiveness stems from its agentic architecture, where each agent is a self-contained unit capable of reasoning about code. The tool’s agent catalog, hosted at agentgg-dev/agentgg-agents, auto-downloads during scans and includes over 100 pre-built agents covering a wide range of security concerns. Users can also create custom agents from past incident reports or security findings, ensuring that historically identified vulnerabilities are proactively detected in future code changes.
How It Works
A scan begins with a fast reconnaissance phase, where agents gather initial context about the project, such as its structure, dependencies, and key components. This phase ensures that subsequent analysis is tailored to the specific codebase being evaluated.
During the scan, agents follow imports, traverse the call graph, and validate findings before reporting them. This multi-step verification process minimizes false positives and ensures that only genuine security issues are flagged. The tool supports two primary scan modes: full repository scans and pull request diff scans. In the latter, agentgg focuses only on the changes introduced in a PR, making it ideal for continuous integration (CI) pipelines.
These reports are stored in an output directory, which also contains a state directory enabling features like scan resumption, status tracking, and revalidation. If a scan is interrupted or re-run with the same output directory, unchanged files are skipped for efficiency. Users can interact with findings locally through a web-based UI or integrate them into broader security workflows.
Users can configure agentgg to work with multiple AI model providers, including Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, or local instances via Ollama. Additionally, agentgg can be run as a hosted service at app.agentgg.dev, eliminating the need for local installation while maintaining the same scanning capabilities.
Use Cases
agentgg is particularly well-suited for organizations and projects that require rigorous security validation of their codebases. Its ability to detect zero-day vulnerabilities makes it valuable for open source maintainers, security researchers, and enterprise development teams. By integrating agentgg into CI pipelines, teams can automatically scan pull requests for security issues before merging, reducing the risk of introducing vulnerabilities into production.
The tool’s custom agent creation feature allows teams to tailor security assessments to their specific needs. For example, an organization that has historically struggled with certain types of vulnerabilities—such as memory corruption bugs or authentication flaws—can generate agents from past incident reports. These agents are then deployed across all repositories to prevent the recurrence of similar issues. This proactive approach aligns with the principle of learning from past mistakes to improve future security posture.
Unlike proprietary SAST tools that often obscure their detection logic, agentgg’s agents are written in readable markdown and versioned like code. This transparency allows developers and security teams to review, audit, and modify agents as needed. It also fosters collaboration within the community, as users can contribute new agents or improvements to existing ones through pull requests.
For enterprises, agentgg offers a scalable solution for security testing at scale. The platform version of agentgg provides on-demand scanning capabilities, with findings integrated directly into GitHub checks and inline comments. The platform also supports role-based access, workspaces, and filtering by severity or agent, making it easier for teams to manage and prioritize security findings.
Key Features and Capabilities
- Agentic Architecture: agentgg uses over 100 AI-driven agents to analyze code contextually. Each agent is designed to investigate specific security concerns, such as unbounded vertex counts in JavaScript visualizations or memory denial-of-service (DoS) vulnerabilities. Agents follow imports and traverse the call graph to confirm findings, reducing false positives.
- Zero-Day Detection: The tool has been instrumental in identifying hundreds of previously unknown vulnerabilities in open source projects. Findings are disclosed responsibly, with private notifications to maintainers followed by public advisories once fixes are released. Each finding is assigned a CVE, ensuring traceability and accountability.
- Custom Agent Creation: Teams can generate custom agents from their historical security data, including incident reports and pentest findings. This feature ensures that vulnerabilities specific to an organization’s codebase or framework are proactively detected in future scans. The processing layer validates these agents before deployment, maintaining reliability.
- Multi-Provider AI Support: agentgg supports integration with multiple AI model providers, including Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, and local models via Ollama. This flexibility allows users to choose the provider that best fits their infrastructure and budget, while also enabling fully local deployments for enhanced privacy.
- It supports both full repository scans and targeted PR diff scans, making it ideal for pre-merge security validation. Findings are presented in a clear, actionable format, with inline comments on GitHub for immediate developer feedback.
- Transparency and Reproducibility: All agents and methodologies are open source and versioned like code. The agent catalog is publicly available, and contributions are welcome through the project’s GitHub repository.
- Hosted and Self-Hosted Options: agentgg can be run as a local CLI tool or accessed via the hosted platform at app.agentgg.dev. The hosted service eliminates the need for local setup while providing the same scanning capabilities. Pricing for the platform is on-demand and competitive, with discounts for high-volume usage.
- Validation and Scoring: Findings are subjected to a second validation pass, where they are assigned CVSS severity scores and deduplicated to avoid redundancy.
- This feature is particularly useful for large codebases or resource-constrained environments, as it avoids reprocessing unchanged files and optimizes scan efficiency.
Technical Implementation and Requirements
agentgg is implemented in TypeScript and requires Node.js 20 or later for local installation. The tool is distributed as a global npm package, which can be installed via the command line. Users must configure an account with one of the supported AI model providers to enable scanning functionality. The setup process involves initializing agentgg with a provider key, after which scans can be executed against repositories or PR diffs.
The tool’s documentation provides detailed guidance on installation, configuration, and usage. It includes a quickstart guide, a reference for scan flags, and troubleshooting resources for common issues. The agentgg platform also offers a GitHub App for automated scanning of repositories, with findings presented as GitHub checks.
Contributions to agentgg are encouraged, with the project maintaining a clear contributing guide, code of conduct, and security policy. Bug reports, agent submissions, and pull requests are all welcome, fostering a collaborative development community. The project’s permissive Apache 2.0 license further encourages adoption and customization by the broader security community.