agentgg

Agentic SAST. White box. CI ready.

agentgg is an agentic SAST scanner. Its agents read your code and reason about it — they follow imports, check the call graph, and confirm a finding before they report it, instead of pattern-matching the way traditional SAST does. Run it over a whole repository, or over a git diff for pull request review. Every scan opens with a fast recon pass that briefs the agents on what the project is, and an interrupted scan resumes on re-run.

Documentation · agentgg.dev · Platform · Agents catalog · Report a bug · Report a security issue

Help us grow and star us on GitHub! ⭐️

agentgg is in beta. Things will move and edges will be rough. Bug reports and feedback are very welcome. Open an issue.

Install

Don't want to run it locally? app.agentgg.dev runs the same scanner as a hosted service: upload a repo, no install, no provider key of your own.

npm install -g agentgg

Requires Node.js 20+. You also need an account with one model provider — Anthropic, OpenAI, AWS Bedrock, Google Vertex AI, OpenRouter, or a local Ollama. See Providers for setup, and CONTRIBUTING.md to build from source.

Quick start

agentgg init                                            # one-time: pick a provider, paste a key
agentgg scan ./src -o ./out                             # scan everything
agentgg scan ./src --diff origin/main...HEAD -o ./out   # PR-style: scan only what changed
agentgg status ./out                                    # what got found and validated
agentgg view ./out                                      # browse findings in a local web UI

A scan writes summary.md and one markdown file per finding into ./out/, plus a state/ directory that makes resume, status, and revalidate work. Re-run with the same -o and unchanged files are skipped; a different -o starts fresh.

Walkthrough: Quickstart.

Documentation

Browse the full documentation at docs.agentgg.dev.

• Quickstart: your first scan
• How a scan runs: the phases, and the defaults
• Providers: set up your model provider
• Scan flags: the full flag reference
• Troubleshooting: when something goes wrong

Agents

An agent is one markdown file: YAML frontmatter that declares where to look and an optional precondition that decides whether the agent is worth running on this repo, plus a markdown body that is the prompt. An agent that declares neither extensions nor filePatterns in its where has no file scope: it gets no pre-selected files and searches the whole repository with its own tools instead. The catalog auto-downloads on first scan from agentgg-dev/agentgg-agents, and agentgg create turns a past incident report into a reusable agent.

Write your own: Agent anatomy · Targeting · Create from reports

Contributing

Bug reports, agents, and pull requests are all welcome. See CONTRIBUTING.md for the dev workflow, CODE_OF_CONDUCT.md for community expectations, and SECURITY.md to report a vulnerability privately.

License

agentgg is licensed under the Apache License, Version 2.0. See LICENSE for the full text and NOTICE for attribution.