需自备至少一家模型提供商的账号和 API key，否则无法扫描；代理目录首次扫描时才从远程仓库自动下载；--live-validate 依赖 Docker，缺失或未启动时会提示安装或启动。
agentgg
agentgg-devApache-2.0活跃维护开源智能体式静态应用安全测试引擎，用 100+ AI 安全智能体扫描任意仓库或 PR diff，支持自带模型，已助力披露数百个零日漏洞。
Open source agentic SAST. The engine behind hundreds of disclosed zero-days. 100+ AI security agents, any repo or PR diff, bring your own model.
暂无版本460star54fork同步于 2026-11-10 06:02 UTC
npm install -g agentgg
agentgg init
agentgg scan ./src -o ./out 硬件要求按 README 说明
README 未说明显存或 GPU 要求；需 Node.js 20+，模型可走 Anthropic、OpenAI、AWS Bedrock、Google Vertex AI、OpenRouter 或本地 Ollama；启用 --live-validate 还需 Docker。
用 AI 代理做白盒 SAST 扫描，可扫整个仓库或 PR diff，自带模型
开源智能体式静态应用安全测试引擎，用 100+ AI 安全智能体扫描任意仓库或 PR diff，支持自带模型，已助力披露数百个零日漏洞。
核心能力
- 代理沿导入和调用图推理，确认后才报漏洞
- 支持整仓库扫描或仅扫 git diff 做 PR 审查
- 扫描前先跑 recon 快速摸底项目背景
- 中断的扫描重跑可续，未变文件自动跳过
- 内置 100+ 安全代理，首次扫描自动下载目录
容易踩的坑
内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README
暂无 release 数据（可能没有发版，或尚未同步）。
用户点评
登录用户的真实使用记录，可按版本和硬件筛选共 0 条
还没有人点评。第一个说出真实体验的人最有价值。
agentgg
Agentic SAST. White box. CI ready.
agentgg is an agentic SAST scanner. Its agents read your code and reason about it — they follow imports, check the call graph, and confirm a finding before they report it, instead of pattern-matching the way traditional SAST does. Run it over a whole repository, or over a git diff for pull request review. Every scan opens with a fast recon pass that briefs the agents on what the project is, and an interrupted scan resumes on re-run.
Documentation · agentgg.dev · Platform · Agents catalog · Report a bug · Report a security issue
Help us grow and star us on GitHub! ⭐️
agentgg is in beta. Things will move and edges will be rough. Bug reports and feedback are very welcome. Open an issue.
Install
Don't want to run it locally? app.agentgg.dev runs the same scanner as a hosted service: upload a repo, no install, no provider key of your own.
npm install -g agentgg
Requires Node.js 20+. You also need an account with one model provider — Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, or a local Ollama. See Providers for setup, and CONTRIBUTING.md to build from source.
Live validation (--live-validate) also needs Docker. If Docker is missing or stopped, agentgg offers to install or start it when the command begins.
Quick start
agentgg init # one-time: pick a provider, paste a key
agentgg scan ./src -o ./out # scan everything
agentgg scan ./src --diff origin/main...HEAD -o ./out # PR-style: scan only what changed
agentgg status ./out # what got found and validated
agentgg view ./out # browse findings in a local web UI
A scan writes summary.md and one markdown file per finding into ./out/, plus a state/ directory that makes resume, status, and revalidate work. Re-run with the same -o and unchanged files are skipped; a different -o starts fresh.
Walkthrough: Quickstart.
Documentation
Browse the full documentation at docs.agentgg.dev.
- Quickstart: your first scan
- How a scan runs: the phases, and the defaults
- Providers: set up your model provider
- Scan flags: the full flag reference
- Troubleshooting: when something goes wrong
Agents
An agent is one markdown file: YAML frontmatter that declares where to look and an optional precondition that decides whether the agent is worth running on this repo, plus a markdown body that is the prompt. An agent that declares neither extensions nor filePatterns in its where has no file scope: it gets no pre-selected files and searches the whole repository with its own tools instead. The catalog auto-downloads on first scan from agentgg-dev/agentgg-agents, and agentgg create turns a past incident report into a reusable agent.
Write your own: Agent anatomy · Targeting · Create from reports
Contributing
Bug reports, agents, and pull requests are all welcome. See CONTRIBUTING.md for the dev workflow, CODE_OF_CONDUCT.md for community expectations, and SECURITY.md to report a vulnerability privately.
License
agentgg is licensed under the Apache License, Version 2.0. See LICENSE for the full text and NOTICE for attribution.